CVE-2021-20591

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-11 · updated 2026-06-17
Weakness: CWE-400

Description

Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all versions, R08/16/32/120SFCPU all versions, R08/16/32/120PCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to prevent legitimate clients from connecting to the MELSOFT transmission port (TCP/IP) by not closing a connection properly, which may lead to a denial of service (DoS) condition.

Affected products

Mitsubishielectric R00Cpu Firmware: all versions
Mitsubishielectric R01Cpu Firmware: all versions
Mitsubishielectric R02Cpu Firmware: all versions
Mitsubishielectric R04Cpu Firmware: all versions
Mitsubishielectric R08Cpu Firmware: all versions
Mitsubishielectric R08Pcpu Firmware: all versions
Mitsubishielectric R08Psfcpu Firmware: all versions
Mitsubishielectric R08Sfcpu Firmware: all versions
Mitsubishielectric R120Cpu Firmware: all versions
Mitsubishielectric R120Pcpu Firmware: all versions
Mitsubishielectric R120Psfcpu Firmware: all versions
Mitsubishielectric R120Sfcpu Firmware: all versions
Mitsubishielectric R16Cpu Firmware: all versions
Mitsubishielectric R16Pcpu Firmware: all versions
Mitsubishielectric R16Psfcpu Firmware: all versions
Mitsubishielectric R16Sfcpu Firmware: all versions
Mitsubishielectric R32Cpu Firmware: all versions
Mitsubishielectric R32Pcpu Firmware: all versions
Mitsubishielectric R32Psfcpu Firmware: all versions
Mitsubishielectric R32Sfcpu Firmware: all versions

References

Get alerted when CVE-2021-20591 or the next vulnerability affects your stack