What is the CVSS score of CVE-2021-20596?

CVE-2021-20596 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 2.2%.

Is there a patch available for CVE-2021-20596?

Yes, a patch is available for CVE-2021-20596. Update the affected software to the latest version immediately.

Fx3U Enet Firmware CVE-2021-20596

HIGH

NULL Pointer Dereference (CWE-476)

2021-07-22 Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Denial Of Service Null Pointer Dereference Fx3U Enet Firmware Fx3U Enet L Firmware Fx3U Enet P502 Firmware Mitsubishielectric

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jul 22, 2021 - 12:15 nvd

HIGH 7.5

DescriptionNVD

NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a DoS condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected and system reset is required for recovery.

AnalysisAI

NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a DoS condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected and system reset is required for recovery. Affected products include: Mitsubishielectric Fx3U-Enet-L Firmware, Mitsubishielectric Fx3U-Enet-P502 Firmware, Mitsubishielectric Fx3U-Enet Firmware. Version information: version 1.14.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.