critical
9.8
CWE
787 119 122
Advisory Published
Updated

CVE-2021-20587: Buffer Overflow

First published: Fri Feb 19 2021(Updated: )

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 versions 1.24A and prior, GT Designer3 Version1(GOT1000) versions 1.250L and prior, GT Designer3 Version1(GOT2000) versions 1.250L and prior, GT SoftGOT1000 Version3 versions 3.245F and prior, GT SoftGOT2000 Version1 versions 1.250L and prior, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer versions 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer versions 1.115U and prior, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) all versions, iQ Monozukuri Process Remote Monitoring (Data Transfer) all versions, M_CommDTM-HART all versions, M_CommDTM-IO-Link versions 1.03D and prior, MELFA-Works versions 4.4 and prior, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) versions 1.015R and prior, MELSOFT Navigator versions 2.74C and prior, MH11 SettingTool Version2 versions 2.004E and prior, MI Configurator versions 1.004E and prior, MT Works2 versions 1.167Z and prior, MX Component versions 5.001B and prior, Network Interface Board CC IE Control utility versions 1.29F and prior, Network Interface Board CC IE Field Utility versions 1.16S and prior, Network Interface Board CC-Link Ver.2 Utility versions 1.23Z and prior, Network Interface Board MNETH utility versions 34L and prior, PX Developer versions 1.53F and prior, RT ToolBox2 versions 3.73B and prior, RT ToolBox3 versions 1.82L and prior, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) versions 4.12N and prior and SLMP Data Collector versions 1.04E and prior) allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.

Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Affected SoftwareAffected VersionHow to fix
Mitsubishielectric C Controller Module Setting And Monitoring Tool
Mitsubishielectric Cpu Module Logging Configuration Tool<=1.112r
Mitsubishielectric Cw Configurator<=1.011m
Mitsubishielectric Data Transfer<=3.44w
Mitsubishielectric Ezsocket
Mitsubishielectric Fr Configurator
Mitsubishielectric Fr Configurator Sw3
Mitsubishielectric Fr Configurator2<=1.24a
Mitsubishielectric Gt Designer3<=1.250l
Mitsubishielectric Gt Softgot1000<=3.245f
Mitsubishielectric Gt Softgot2000<=1.250l
Mitsubishielectric Gx Configurator-dp<=7.14q
Mitsubishielectric Gx Configurator-qp
Mitsubishielectric Gx Developer<=8.506c
Mitsubishielectric Gx Explorer
Mitsubishielectric Gx Iec Developer
Mitsubishielectric Gx Logviewer<=1.115u
Mitsubishielectric Gx Remoteservice-i
Mitsubishielectric Gx Works2<=1.597x
Mitsubishielectric Gx Works3<=1.070y
Mitsubishielectric Iq Monozukuri Andon
Mitsubishielectric Iq Monozukuri Process Remote Monitoring
Mitsubishielectric M Commdtm-hart
Mitsubishielectric M Commdtm-io-link
Mitsubishielectric Melfa-works<=4.4
Mitsubishielectric Melsec Wincpu Setting Utility
Mitsubishielectric Melsoft Em Software Development Kit
Mitsubishielectric Melsoft Navigator<=2.74c
Mitsubishielectric Mh11 Settingtool Version2<=2.004e
Mitsubishielectric Mi Configurator
Mitsubishielectric Mt Works2<=1.167z
Mitsubishielectric Mx Component<=5.001b
Mitsubishielectric Network Interface Board Cc-link
Mitsubishielectric Network Interface Board Cc Ie Control Utility
Mitsubishielectric Network Interface Board Cc Ie Field Utility
Mitsubishielectric Network Interface Board Mneth Utility
Mitsubishielectric Px Developer<=1.53f
Mitsubishielectric Rt Toolbox2<=3.73b
Mitsubishielectric Rt Toolbox3<=1.82l
Mitsubishielectric Setting\/monitoring Tools For The C Controller Module
Mitsubishielectric Slmp Data Collector<=1.04e
Mitsubishi Electric CPU Module Logging Configuration Tool, Versions 1.112R and prior
Mitsubishi Electric CW Configurator, Versions 1.011M and prior
Mitsubishi Electric Data Transfer, Versions 3.44W and prior
Mitsubishi Electric EZSocket, Versions 5.4 and prior
Mitsubishi Electric FR Configurator, All versions
Mitsubishi Electric FR Configurator SW3, all versions
Mitsubishi Electric FR Configurator2, Versions 1.24A and prior
Mitsubishi Electric GT Designer3 Version1(GOT1000), Versions 1.250L and prior
Mitsubishi Electric GT Designer3 Version1(GOT2000), Versions 1.250L and prior
Mitsubishi Electric GT SoftGOT1000 Version3, Versions 3.245F and prior
Mitsubishi Electric GT SoftGOT2000 Version1, Versions 1.250L and prior
Mitsubishi Electric GX Configurator-DP, Versions 7.14Q and prior
Mitsubishi Electric GX Configurator-QP, All versions
Mitsubishi Electric GX Developer, Versions 8.506C and prior
Mitsubishi Electric GX Explorer, All versions
Mitsubishi Electric GX IEC Developer, All versions
Mitsubishi Electric GX LogViewer, Versions 1.115U and prior
Mitsubishi Electric GX RemoteService-I, All versions
Mitsubishi Electric GX Works2, Versions 1.597X and prior
Mitsubishi Electric GX Works3, Versions 1.070Y and prior
Mitsubishi Electric iQ Monozukuri ANDON (Data Transfer), All versions
Mitsubishi Electric iQ Monozukuri Process Remote Monitoring (Data Transfer), All versions
Mitsubishi Electric M_CommDTM-HART, All versions
Mitsubishi Electric M_CommDTM-IO-Link, Versions 1.03D and prior
Mitsubishi Electric MELFA-Works, Versions 4.4 and prior
Mitsubishi Electric MELSEC WinCPU Setting Utility, all versions

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID?

    The vulnerability ID is CVE-2021-20587.

  • What is the severity of CVE-2021-20587?

    The severity of CVE-2021-20587 is critical with a CVSS score of 9.8.

  • Which software versions are affected by CVE-2021-20587?

    Mitsubishi Electric FA Engineering Software versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, and more.

  • What is the Common Weakness Enumeration (CWE) ID of CVE-2021-20587?

    The CWE ID of CVE-2021-20587 is CWE-119 and CWE-787.

  • Where can I find more information about CVE-2021-20587?

    You can find more information about CVE-2021-20587 in the following references: [JVN](https://jvn.jp/vu/JVNVU92330101/index.html), [US-CERT](https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02), [Mitsubishi Electric PSIRT](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdf).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203