CVE-2021-20608 Denial of service in GX Works2
Remote unauthenticated attackers can cause a denial of service in Mitsubishi GX Works2 by sending malicious packets to tamper with PLC program files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20608?
CVE-2021-20608 is a high-severity denial of service vulnerability in GX Works2, published on 17 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.
Which versions are affected by CVE-2021-20608?
It affects 1 product.
Products include Mitsubishielectric Gx Works2.
How do I fix CVE-2021-20608?
No fix has been published for CVE-2021-20608 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20608 being exploited?
There is no known exploitation of CVE-2021-20608 in the wild and no public exploit code.
Other vulnerabilities in GX Works2
Sources
Also known as GHSA-jvfx-87xv-97xc.