Skip to content
Fencer Vulns
high 7.5

CVE-2021-20611 json

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU,…

published 2021-12-01 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8029

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-334-02 updated cvss 7.5

Mitsubishi Electric MELSEC and MELIPC Series (Update G)

  • Mitsubishi Electric MELIPC Series MI5122-VW Firmware <=05 Mitsubishi Electric MELSEC iQ-R Series R00CPU Firmware <=24 Mitsubishi Electric MELSEC iQ-R Series R01CPU Firmware <=24 Mitsubishi Electric MELSEC iQ-R Series R02CPU Firmware <=24 Mitsubishi Electric MELSEC iQ-R Series R04(EN)CPU Firmware <=57 Mitsubishi Electric MELSEC iQ-R Series R08(EN)CPU Firmware <=57
    +34 more products
    Mitsubishi Electric MELSEC iQ-R Series R08PCPU Firmware <=29 Mitsubishi Electric MELSEC iQ-R Series R08PSFCPU Firmware <=08 Mitsubishi Electric MELSEC iQ-R Series R08SFCPU Firmware <=26 Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V Firmware <=16 Mitsubishi Electric MELSEC iQ-R Series R16(EN)CPU Firmware <=57 Mitsubishi Electric MELSEC iQ-R Series R16MTCPU Operating system <=23 Mitsubishi Electric MELSEC iQ-R Series R16PCPU Firmware <=29 Mitsubishi Electric MELSEC iQ-R Series R16PSFCPU Firmware <=08 Mitsubishi Electric MELSEC iQ-R Series R16SFCPU Firmware <=26 Mitsubishi Electric MELSEC iQ-R Series R32(EN)CPU Firmware <=57 Mitsubishi Electric MELSEC iQ-R Series R32MTCPU Operating system <=23 Mitsubishi Electric MELSEC iQ-R Series R32PCPU Firmware <=29 Mitsubishi Electric MELSEC iQ-R Series R32PSFCPU Firmware <=08 Mitsubishi Electric MELSEC iQ-R Series R32SFCPU Firmware <=26 Mitsubishi Electric MELSEC iQ-R Series R64MTCPU Operating system <=23 Mitsubishi Electric MELSEC iQ-R Series R120(EN)CPU Firmware <=57 Mitsubishi Electric MELSEC iQ-R Series R120PCPU Firmware <=29 Mitsubishi Electric MELSEC iQ-R Series R120PSFCPU Firmware <=08 Mitsubishi Electric MELSEC iQ-R Series R120SFCPU Firmware <=26 Mitsubishi Electric MELSEC L Series L02CPU(-P) The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC L Series L06CPU(-P) The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC L Series L26CPU-(P)BT The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC L Series L26CPU(-P) The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC Q Series MR-MQ100 Operating system <=F Mitsubishi Electric MELSEC Q Series Q03UDECPU The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC Q Series Q03UDVCPU The first 5 digits of serial No. <=23071 Mitsubishi Electric MELSEC Q Series Q04UDEHCPU The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC Q Series Q04UDPVCPU The first 5 digits of serial No. <=23071 Mitsubishi Electric MELSEC Q Series Q04UDVCPU The first 5 digits of serial No. <=23071 Mitsubishi Electric MELSEC Q Series Q06UDEHCPU The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC Q Series Q06UDPVCPU The first 5 digits of serial No. <=23071 Mitsubishi Electric MELSEC Q Series Q06UDVCPU The first 5 digits of serial No. <=23071 Mitsubishi Electric MELSEC Q Series Q10UDEHCPU The first 5 digits of serial No. <=23121 Mitsubishi Electric MELSEC Q Series Q12DCCPU-V The first 5 digits of serial No. <=24031
    affected: vendor fix, mitigation “Mitsubishi Electric corrected the vulnerabilities in the following products and intends to do the same with other products.” mitsubishielectric.com

18 more affected in the full advisory

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Mitsubishi Electric Corporation MELSEC iQ-R Series R00CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R01CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R02CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R04CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R04ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16MTCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32MTCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R64MTCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V
  • Mitsubishi Electric Corporation MELSEC Q Series Q03UDECPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q04UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q06UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q10UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q13UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q20UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q26UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q50UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q100UDEHCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q03UDVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q04UDVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q06UDVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q13UDVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q26UDVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q04UDPVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q06UDPVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q13UDPVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q26UDPVCPU
  • Mitsubishi Electric Corporation MELSEC Q Series Q12DCCPU-V
  • Mitsubishi Electric Corporation MELSEC Q Series Q24DHCCPU-V
  • Mitsubishi Electric Corporation MELSEC Q Series Q24DHCCPU-VG

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.