CVE-2021-20608
Quick assessment
Affected
n/a GX Works2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mitsubishi Electric GX Works2是日本三菱（Mitsubishi Electric）公司的一款可编程控制器。 Mitsubishi Electric GX Works2 存在安全漏洞，攻击者可利用该漏洞通过向PLC发送恶意制作的数据包来篡改三菱电机PLC中的程序文件，将程序文件读入GX Works2，工程软件会错误地处理与关联数据实际长度不一致的长度字段，这可能会导致软件出现拒绝服务的情况。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-20608
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Mitsubishi Electric GX Works2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric GX Works2是日本三菱（Mitsubishi Electric）公司的一款可编程控制器。 Mitsubishi Electric GX Works2 存在安全漏洞，攻击者可利用该漏洞通过向PLC发送恶意制作的数据包来篡改三菱电机PLC中的程序文件，将程序文件读入GX Works2，工程软件会错误地处理与关联数据实际长度不一致的长度字段，这可能会导致软件出现拒绝服务的情况。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | GX Works2 | versions 1.606G and prior | - |
|
II. Public POCs for CVE-2021-20608
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-20608
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-20608 (2)
-
https://jvn.jp/vu/JVNVU93019896/index.html x_refsource_MISC
-
https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04 x_refsource_MISC
Other References for CVE-2021-20608 (1)
Same Patch Batch · n/a · 2021-12-17 · 51 CVEs total
| CVE-2021-23803 | 9.8 CRITICAL | Access Control Bypass |
| CVE-2021-23450 | 7.5 HIGH | Prototype Pollution |
| CVE-2021-23797 | 7.5 HIGH | Directory Traversal |
| CVE-2021-23814 | 6.7 MEDIUM | laravel-filemanager代码问题漏洞 |
| CVE-2021-44035 | 4.4 MEDIUM | Wolters Kluwer TeamMate AM 安全漏洞 |
| CVE-2021-0676 | MediaTek 芯片 缓冲区错误漏洞 | |
| CVE-2021-4008 | xorg-x11-server 缓冲区错误漏洞 | |
| CVE-2021-4010 | xorg-x11-server 缓冲区错误漏洞 | |
| CVE-2021-4009 | xorg-x11-server 缓冲区错误漏洞 | |
| CVE-2021-4011 | xorg-x11-server 缓冲区错误漏洞 | |
| CVE-2021-32497 | SICK SOPAS ET安全漏洞 | |
| CVE-2021-32498 | SICK SOPAS ET 4.8.0 路径遍历漏洞 | |
| CVE-2021-32499 | SICK SOPAS ET 注入漏洞 | |
| CVE-2021-0677 | MediaTek Ccu 输入验证错误漏洞 | |
| CVE-2021-42584 | Nordaaker Convos 跨站脚本漏洞 | |
| CVE-2021-0678 | MediaTek Apusys缓冲区错误漏洞 | |
| CVE-2021-0893 | MediaTek Apusys 资源管理错误漏洞 | |
| CVE-2021-0679 | MediaTek Apusys缓冲区错误漏洞 | |
| CVE-2021-0894 | MediaTek Apusys缓冲区错误漏洞 | |
| CVE-2021-0895 | MediaTek Apusys缓冲区错误漏洞 |
Showing top 20 of 51 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-20608
No comments yet