CVE-2021-20588

Vulnerability

CVE-2021-20588 is an Improper Handling of Length Parameter Inconsistency vulnerability found in a wide range of Mitsubishi Electric FA Engineering Software products. The flaw occurs in components that communicate with MELSEC, FREQROL, or GOT devices, where the software does not properly validate length parameters in network messages. Affected versions include CPU Module Logging Configuration Tool 1.112R and prior, CW Configurator 1.011M and prior, Data Transfer 3.44W and prior, EZSocket 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 1.24A and prior, GT Designer3 Version1(GOT1000) 1.250L and prior, GT Designer3 Version1(GOT2000) 1.250L and prior, GT SoftGOT1000 Version3 3.245F and prior, GT SoftGOT2000 Version1 1.250L and prior, GX Configurator-DP 7.14Q and prior, GX Configurator-QP all versions, GX Developer 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer 1.115U and prior, GX RemoteService-I all versions, GX Works2 1.597X and prior, GX Works3 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) 1.003D and prior, iQ Monozukuri Process Remote Monitoring (Data Transfer) 1.002C and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link 1.03D and prior, MELFA-Works 4.4 and prior, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) 1.015R and prior, MELSOFT Navigator 2.74C and prior, MH11 SettingTool Version2 2.004E and prior, MI Configurator 1.004E and prior, MT Works2 1.167Z and prior, MX Component 5.001B and prior, Network Interface Board CC IE Control utility 1.29F and prior, Network Interface Board CC IE Field Utility 1.16S and prior, Network Interface Board CC-Link Ver.2 Utility 1.23Z and prior, Network Interface Board MNETH utility 34L and prior, PX Developer 1.53F and prior, RT ToolBox2 3.73B and prior, RT ToolBox3 1.82L and prior, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) 4.12N and prior, and SLMP Data Collector. [1][2]

Exploitation

An attacker can exploit this vulnerability remotely with low attack complexity. The attack requires no authentication or user interaction, and can be carried out by sending a specially crafted network packet containing an inconsistent length parameter to the target software. The attacker does not need special network position beyond network access to the affected product's communication interface. [1]

Impact

Successful exploitation triggers a denial-of-service (DoS) condition in the affected product, potentially causing the engineering software to crash or become unresponsive. According to the risk evaluation, the vulnerability does not lead to code execution or information disclosure, but the DoS can disrupt engineering and maintenance operations in industrial control environments. [1]

Mitigation

Mitsubishi Electric has not released a specific fix for this vulnerability as of the publication date. The advisory recommends users apply the latest version of the affected products when a patch becomes available. In the interim, users should restrict network access to the engineering software to trusted hosts and implement network segmentation to limit exposure. No CISA KEV listing is associated with this CVE. [1]