High ICSA-21-334-02 3 CVEs

Mitsubishi Electric MELSEC and MELIPC Series (Update G)

Published Nov 30, 2021 · Updated Nov 9, 2023 · Revision 8

Vendor: Mitsubishi Electric Product: MELIPC Series MI5122-VW Firmware Product: MELSEC iQ-R Series R00CPU Firmware Product: MELSEC iQ-R Series R01CPU Firmware Product: MELSEC iQ-R Series R02CPU Firmware Product: MELSEC iQ-R Series R04(EN)CPU Firmware Product: MELSEC iQ-R Series R08(EN)CPU Firmware Product: MELSEC iQ-R Series R08PCPU Firmware Product: MELSEC iQ-R Series R08PSFCPU Firmware Product: MELSEC iQ-R Series R08SFCPU Firmware Product: MELSEC iQ-R Series R120(EN)CPU Firmware Product: MELSEC iQ-R Series R120PCPU Firmware Product: MELSEC iQ-R Series R120PSFCPU Firmware Product: MELSEC iQ-R Series R120SFCPU Firmware Product: MELSEC iQ-R Series R12CCPU-V Firmware Product: MELSEC iQ-R Series R16(EN)CPU Firmware Product: MELSEC iQ-R Series R16MTCPU Operating system Product: MELSEC iQ-R Series R16PCPU Firmware Product: MELSEC iQ-R Series R16PSFCPU Firmware Product: MELSEC iQ-R Series R16SFCPU Firmware Product: MELSEC iQ-R Series R32(EN)CPU Firmware Product: MELSEC iQ-R Series R32MTCPU Operating system Product: MELSEC iQ-R Series R32PCPU Firmware Product: MELSEC iQ-R Series R32PSFCPU Firmware Product: MELSEC iQ-R Series R32SFCPU Firmware Product: MELSEC iQ-R Series R64MTCPU Operating system Product: MELSEC L Series L02CPU(-P) The first 5 digits of serial No. Product: MELSEC L Series L06CPU(-P) The first 5 digits of serial No. Product: MELSEC L Series L26CPU-(P)BT The first 5 digits of serial No. Product: MELSEC L Series L26CPU(-P) The first 5 digits of serial No. +29 more

Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition. Recovery requires a system reset.

Vulnerabilities 3

High 7.5

CVE-2021-20609

Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Ser…

Mitsubishi Electric MELSEC-Q Series Q26UDVCPU MELSEC-Q Series Q06UDPVCPU MELSEC-Q Series Q26UDPVCPU ICS / OT

Dec 1, 2021
High 7.5

CVE-2021-20610

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CP…

Mitsubishi Electric MELSEC-Q Series Q26UDPVCPU MELSEC-Q Series Q04UDVCPU MELSEC-Q Series Q13UDVCPU ICS / OT

Dec 1, 2021
High 7.5

CVE-2021-20611

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/…

Mitsubishi Electric MELSEC-Q Series Q03UDVCPU MELSEC-Q Series Q06UDVCPU MELSEC-Q Series Q26UDVCPU ICS / OT

Dec 1, 2021

Revision history

2023-11-09 #8
Update G - Added modules that have been fixed
2023-05-09 #7
Update F - Added additional products and mitigations
2022-11-29 #6
Update E - ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update E)
2022-08-01 #5
Update D - ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update D)
2022-06-07 #4
Update C - ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update C)
2022-04-26 #3
Update B - ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update B)
2022-01-27 #2
Update A - ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update A)
2021-11-30 #1
Initial Publication

References

ICSA Advisory ICSA-21-334-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-334-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/ics/Recommended-Practices
Recommended Practices
https://cisa.gov/ics
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B