Mitsubishi Electric FA Engineering Software Buffer Overflow & Error Handling Vulnerabilities (CVE-2021-20587/20588)

Critical Vulnerability Information Vulnerability ID IVNVU#92330101 Affected Products Multiple vulnerabilities exist in Mitsubishi Electric's FA engineering software products. Specific Vulnerabilities 1. Buffer Overflow - CWE: CWE-122 - CVE: CVE-2021-20587 - CVSS v3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A/A:I - Base Score: 7.5 2. Improper Error Handling - CWE: CWE-190 - CVE: CVE-2021-20588 - CVSS v3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A/A:I - Base Score: 7.5 Potential Impact When connected to third-party Mitsubishi Electric security gateways, GUIs, or when using inverters with Mitsubishi Electric products, maliciously crafted response packets may be returned, causing the device to enter a Denial of Service (DoS) state. May lead to execution of malicious programs. Mitigation Measures Update - For products and versions with available patches, apply the patches as per the provided information. - For cases where patches cannot be applied, refer to the vendor’s guidance for workaround measures. - For products or versions without available patches, consult the vendor’s information for further details. Workplace Mitigation - For affected products currently in use or where patching is not feasible, refer to the vendor’s guidance for workaround measures. Update History 2021/02/19: Added ICS Advisory link 2021/05/27: Updated affected systems and mitigation measures 2021/07/27: Updated affected systems and mitigation measures 2021/11/16: Updated affected systems and mitigation measures 2022/02/08: Updated affected systems and mitigation measures 2022/05/24: Updated affected systems and mitigation measures 2022/07/28: Updated affected systems and mitigation measures 2022/08/02: Updated mitigation measures 2022/11/17: Updated affected systems and mitigation measures 2022/09/05: Updated details, affected systems, and mitigation measures

Goal Reached Thanks to every supporter — we hit 100%!

Mitsubishi Electric FA Engineering Software Buffer Overflow & Error Handling Vulnerabilities (CVE-2021-20587/20588)