CVE-2021-20608

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.

• https://jvn.jp/vu/JVNVU93019896/index.htmlThird Party Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04Third Party Advisory, US Government Resource
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-020_en.pdfVendor Advisory
• https://jvn.jp/vu/JVNVU93019896/index.htmlThird Party Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04Third Party Advisory, US Government Resource
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-020_en.pdfVendor Advisory

Published

Dec 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20602Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20603Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20604Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20605Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20606Out-of-bounds Read vulnerability in Mitsubishi Electric GX W…5.5
• CVE-2021-20607Integer Underflow vulnerability in Mitsubishi Electric GX Wo…5.5
• CVE-2021-20609Uncontrolled Resource Consumption vulnerability in Mitsubish…7.5
• CVE-2021-2061Vulnerability in the MySQL Server product of Oracle MySQL (c…4.4
• CVE-2021-20610Improper Handling of Length Parameter Inconsistency vulnerab…7.5
• CVE-2021-20611Improper Input Validation vulnerability in Mitsubishi Electr…7.5
• CVE-2021-20612Lack of administrator control over security vulnerability in…7.5
• CVE-2021-20613Improper initialization vulnerability in MELSEC-F series FX3…7.5