« Volver al listado

CVE-2021-20600

Estado: ModificadaMedia (5.9)—

Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up. System reset is required for recovery.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mitsubishielectric — R12ccpu-v Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-20600",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V",
          "versions": [
            {
              "status": "affected",
              "version": "Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions \"16\" and prior"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-08T17:15:07.437",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU94914666/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-015_en.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://jvn.jp/vu/JVNVU94914666/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-015_en.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions \"16\" and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up. System reset is required for recovery."
    },
    {
      "lang": "es",
      "value": "El consumo incontrolado de recursos en el módulo controlador C de la serie MELSEC iQ-R de Mitsubishi Electric R12CCPU-V, versiones de firmware \"16\" y anteriores, permite que un atacante remoto no autenticado provoque una condición de denegación de servicio (DoS) mediante el envío de un gran número de paquetes en poco tiempo durante el arranque del módulo. Se requiere un reinicio del sistema para la recuperación"
    }
  ],
  "lastModified": "2026-06-17T03:34:05.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mitsubishielectric:r12ccpu-v_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B011D41D-5119-403C-A0A6-C872DA1ABB54",
              "versionEndIncluding": "16"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mitsubishielectric:r12ccpu-v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8B938943-DDD5-43DC-98A3-29D0E6AFBF85"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}