CVE-2021-20587

Опубликовано: 19 фев. 2021

Источник: nvd

CVSS3: 7.5

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 versions 1.24A and prior, GT Designer3 Version1(GOT1000) versions 1.250L and prior, GT Designer3 Version1(GOT2000) versions 1.250L and prior, GT SoftGOT1000 Version3 versions 3.245F and prior, GT SoftGOT2000 Version1 versions 1.250L and prior, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer versions 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer versions 1.115U and prior, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) versions 1.003D and prior, iQ Monozukuri Proces

Ссылки

https://jvn.jp/vu/JVNVU92330101
https://www.cisa.gov/news-events/ics-advisories/icsa-21-049-02
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-021_en.pdf
https://jvn.jp/vu/JVNVU92330101/index.html
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02
Third Party Advisory
US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdf
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mitsubishielectric:c_controller_module_setting_and_monitoring_tool:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:*

Версия до 1.112r (включая)

cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:*

Версия до 1.011m (включая)

cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:*

Версия до 3.44w (включая)

cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:fr_configurator:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:fr_configurator_sw3:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:*

Версия до 1.24a (включая)

cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:*

Версия до 1.250l (включая)

cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:*

Версия до 3.245f (включая)

cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:*

Версия до 1.250l (включая)

cpe:2.3:a:mitsubishielectric:gx_configurator-dp:*:*:*:*:*:*:*:*

Версия до 7.14q (включая)

cpe:2.3:a:mitsubishielectric:gx_configurator-qp:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:gx_developer:*:*:*:*:*:*:*:*

Версия до 8.506c (включая)

cpe:2.3:a:mitsubishielectric:gx_explorer:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:gx_iec_developer:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:*

Версия до 1.115u (включая)

cpe:2.3:a:mitsubishielectric:gx_remoteservice-i:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:*

Версия до 1.597x (включая)

cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*

Версия до 1.070y (включая)

cpe:2.3:a:mitsubishielectric:iq_monozukuri_andon:-:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:iq_monozukuri_process_remote_monitoring:-:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:*

Версия до 4.4 (включая)

cpe:2.3:a:mitsubishielectric:melsec_wincpu_setting_utility:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:melsoft_em_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*

Версия до 2.74c (включая)

cpe:2.3:a:mitsubishielectric:mh11_settingtool_version2:*:*:*:*:*:*:*:*

Версия до 2.004e (включая)

cpe:2.3:a:mitsubishielectric:mi_configurator:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:*

Версия до 1.167z (включая)

cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:*

Версия до 5.001b (включая)

cpe:2.3:a:mitsubishielectric:network_interface_board_cc-link:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_control_utility:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_field_utility:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:network_interface_board_mneth_utility:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:px_developer:*:*:*:*:*:*:*:*

Версия до 1.53f (включая)

cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:*

Версия до 3.73b (включая)

cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:*

Версия до 1.82l (включая)

cpe:2.3:a:mitsubishielectric:setting\/monitoring_tools_for_the_c_controller_module:*:*:*:*:*:*:*:*

cpe:2.3:a:mitsubishielectric:slmp_data_collector:*:*:*:*:*:*:*:*

Версия до 1.04e (включая)

EPSS

Процентиль: 92%

0.09006

Низкий

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-122

CWE-787

Связанные уязвимости

GHSA-66m6-mhcr-vj8v

CVSS3: 9.8

github

больше 3 лет назад

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (C Controller module setting and monitoring tool all versions, CPU Module Logging Configuration Tool all versions, CW Configurator all versions, Data Transfer all versions, EZSocket all versions, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GT SoftGOT1000 Version3 all versions, GT SoftGOT2000 Version1 all versions, GX Configurator-DP version 7.14Q and prior, GX Configurator-QP all versions, GX Developer all versions, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer all versions, GX RemoteService-I all versions, GX Works2 version 1.597X and prior, GX Works3 version 1.070Y and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link all versions, MELFA-Works all versions, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Developm...

EPSS

Процентиль: 92%

0.09006

Низкий

7.5 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-122

CWE-787