CVE-2021-20606

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-20606
Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://jvn.jp/vu/JVNVU93817405/index.html Patch Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05 Third Party Advisory US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdf Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:*
cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:*
cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*
History

29 Jul 2022, 16:15

Type Values Removed Values Added
Summary Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket all versions allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker. Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.

01 Jul 2022, 15:15

Type Values Removed Values Added
Summary Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, MELSOFT Navigator all versions and EZSocket all versions allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker. Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket all versions allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.

27 Dec 2021, 18:09

Type Values Removed Values Added
References (MISC) https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdf - (MISC) https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdf - Patch, Vendor Advisory
References (MISC) https://jvn.jp/vu/JVNVU93817405/index.html - (MISC) https://jvn.jp/vu/JVNVU93817405/index.html - Patch, Third Party Advisory
References (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05 - (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05 - Third Party Advisory, US Government Resource
CPE cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:*
cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:*
cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*
CWE CWE-125
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 5.5

17 Dec 2021, 18:36

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-17 17:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-20606

Mitre link : CVE-2021-20606

CVE.ORG link : CVE-2021-20606

JSON object : View

Products Affected

mitsubishielectric

  • ezsocket
  • gx_works2
  • melsoft_navigator
CWE
CWE-125

Out-of-bounds Read