CVE-2021-20599 - Vulnerability Details - OpenCVE

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00332.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R08SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R16SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R32SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R120SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R16PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R32PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R120PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors	Products
Mitsubishielectric Subscribe	R08psfcpu Subscribe R08psfcpu Firmware Subscribe R08sfcpu Subscribe R08sfcpu Firmware Subscribe R120psfcpu Subscribe R120psfcpu Firmware Subscribe R120sfcpu Subscribe R120sfcpu Firmware Subscribe R16psfcpu Subscribe R16psfcpu Firmware Subscribe R16sfcpu Subscribe R16sfcpu Firmware Subscribe R32psfcpu Subscribe R32psfcpu Firmware Subscribe R32sfcpu Subscribe R32sfcpu Firmware Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2021-8017	Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://jvn.jp/vu/JVNVU98578731
https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Mitsubishi

Published: 2021-10-14T00:00:00

Updated: 2024-08-03T17:45:44.681Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20599

Vulnrichment

Updated: 2024-08-03T17:45:44.681Z

NVD

Status : Modified

Published: 2021-10-14T15:15:08.827

Modified: 2024-11-21T05:46:51.317

Link: CVE-2021-20599

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-20599", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "assignerShortName": "Mitsubishi", "dateUpdated": "2024-08-03T17:45:44.681Z", "dateReserved": "2020-12-17T00:00:00", "datePublished": "2021-10-14T00:00:00"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R16SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R32SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R120SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}], "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-04-18T05:28:04.068Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"tags": ["government-resource"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"tags": ["government-resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-20599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T20:51:10.357119Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "melsec_iq-r08sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r08psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:12:41.515Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:44.681Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"tags": ["government-resource", "x_transferred"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://jvn.jp/vu/JVNVU98578731", "tags": ["government-resource", "x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03", "tags": ["government-resource", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:44.681Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-20599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T20:51:10.357119Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "melsec_iq-r08sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r08psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-22T20:56:35.290Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R16SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R32SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R120SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf", "tags": ["vendor-advisory"]}, {"url": "https://jvn.jp/vu/JVNVU98578731", "tags": ["government-resource"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.", "supportingMedia": [{"type": "text/html", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-04-18T05:28:04.068Z"}}}, "cveMetadata": {"cveId": "CVE-2021-20599", "state": "PUBLISHED", "dateUpdated": "2024-08-03T17:45:44.681Z", "dateReserved": "2020-12-17T00:00:00", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "datePublished": "2021-10-14T00:00:00", "assignerShortName": "Mitsubishi"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "66D3AC7B-50E0-47D5-B0D1-07329D724EFE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "B185323A-C9E3-48A0-AD28-DA7AC7846E18", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA81D5C7-46C8-4F0E-9550-D240DC0366F3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "C4BBE066-33C4-4410-85D3-4B77B3773330", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8218130C-4E7D-4FB9-976B-2351977C82D4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "515BDC46-5A1C-4A94-816A-B4751BB1B58D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A63D33D-302A-428C-986F-FC3F83CE9C86", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA37F2FC-8F75-4FEA-882D-87AD5CC1558E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FFB42739-E503-44B2-A020-0DB2B8791A81", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "17AD5875-B7D7-498B-9484-23049753133E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "0EC2594C-6067-40BA-B8B2-AEC9B9C7922F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2C03EA2-34BF-4F86-A19C-2818788E092B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA3FB3E1-D7D3-424B-A207-D3C6F4365D12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}, {"lang": "es", "value": "La vulnerabilidad de transmisi\u00f3n de texto claro de informaci\u00f3n sensible en las versiones de firmware \"26\" y anteriores de la CPU de seguridad R08/16/32/120SFCPU de la serie iQ-R de MELSEC y en la CPU de proceso SIL2 R08/16/32/120PSFCPU de la serie iQ-R de MELSEC, en todas sus versiones, permite que un atacante remoto no autenticado inicie sesi\u00f3n en un m\u00f3dulo de CPU objetivo obteniendo credenciales distintas de la contrase\u00f1a"}], "id": "CVE-2021-20599", "lastModified": "2024-11-21T05:46:51.317", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-14T15:15:08.827", "references": [{"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}], "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Secondary"}]}