CVE-2021-20598

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to lockout a legitimate user by continuously trying login with incorrect password.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-08-06 17:15

Updated : 2024-02-28 18:28


NVD link : CVE-2021-20598

Mitre link : CVE-2021-20598

CVE.ORG link : CVE-2021-20598


JSON object : View

Products Affected

mitsubishielectric

  • r32sfcpu_firmware
  • r120sfcpu_firmware
  • r120psfcpu_firmware
  • r32sfcpu
  • r16sfcpu
  • r16psfcpu
  • r120psfcpu
  • r32psfcpu_firmware
  • r16psfcpu_firmware
  • r32psfcpu
  • r120sfcpu
  • r08psfcpu
  • r08sfcpu_firmware
  • r08sfcpu
  • r16sfcpu_firmware
  • r08psfcpu_firmware
CWE
CWE-287

Improper Authentication