CVE-2021-20586 Denial of service in Robot Controller MELFA FR Series; Robot Controller CR Series; Cooperative Robot ASSISTA
Remote unauthenticated attackers can cause denial of service in Mitsubishi MELFA and ASSISTA robot controllers by flooding them with burst packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20586?
CVE-2021-20586 is a high-severity denial of service vulnerability in Robot Controller MELFA FR Series; Robot Controller CR Series; Cooperative Robot ASSISTA, published on 29 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-*V*D" of RV-*FR***-D-* all versions, controller "CR800-*HD" of RH-*FRH***-D-* all versions, controller "CR800-*HRD" of RH-*FRHR***-D-* all versions, controller "CR800-*V*R with R16RTCPU" of RV-*FR***-R-* all versions, controller "CR800-*HR with R16RTCPU" of RH-*FRH***-R-* all versions, controller "CR800-*HRR with R16RTCPU" of RH-*FRHR***-R-* all versions, controller "CR800-*V*Q with Q172DSRCPU" of RV-*FR***-Q-* all versions, controller "CR800-*HQ with Q172DSRCPU" of RH-*FRH***-Q-* all versions, controller "CR800-*HRQ with Q172DSRCPU" of RH-*FRHR***-Q-* all versions) and a robot controller of MELFA CR Series(controller "CR800-CVD" of RV-8CRL-D-* all versions, controller "CR800-CHD" of RH-*CRH**-D-* all versions) as well as a cooperative robot ASSISTA(controller "CR800-05VD" of RV-5AS-D-* all versions) allows a remote unauthenticated attacker to cause a DoS of the execution of the robot program and the Ethernet communication by sending a large amount of packets in burst over a short period of time. As a result of DoS, an error may occur. A reset is required to recover it if the error occurs.
Which versions are affected by CVE-2021-20586?
It affects 33 products.
Products include Mitsubishielectric Rh12frh55 Firmware, Mitsubishielectric Rh12frh85 Firmware, Mitsubishielectric Rh12rfh70 Firmware, Mitsubishielectric Rh1frhr Firmware, Mitsubishielectric Rh20frh100 Firmware, Mitsubishielectric Rh20frh85 Firmware and 27 more.
How do I fix CVE-2021-20586?
No fix has been published for CVE-2021-20586 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20586 being exploited?
There is no known exploitation of CVE-2021-20586 in the wild and no public exploit code.
Sources
Also known as GHSA-c9mw-29g5-hf3h.