CVE-2021-20610

Name: CVE-2021-20610
Creator: NVD / NIST
Published: 2021-12-01T16:15:07.51+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 3.08%

Last modified Jun 17, 2026

CVE-2021-20610 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.. EPSS estimates a 3.08% chance of exploitation in the next 30 days.

Description

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

3.08%

86.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-130

Affected Software

Vendor	Product	Versions
Mitsubishi	Melsec Iq-R R00 Cpu Firmware	<= 24
Mitsubishi	Melsec Iq-R R01 Cpu Firmware	<= 24
Mitsubishi	Melsec Iq-R R02 Cpu Firmware	<= 24
Mitsubishi	Melsec Iq-R R04 Cpu Firmware	<= 57
Mitsubishi	Melsec Iq-R R08 Cpu Firmware	<= 57
Mitsubishi	Melsec Iq-R R120 Cpu Firmware	<= 57
Mitsubishi	Melsec Iq-R R16 Cpu Firmware	<= 57
Mitsubishi	Melsec Iq-R R32 Cpu Firmware	<= 57
Mitsubishi	Melsec Iq-R R04 Pcpu Firmware	<= 29
Mitsubishi	Melsec Iq-R R08 Pcpu Firmware	<= 29
Mitsubishi	Melsec Iq-R R16 Pcpu Firmware	<= 29
Mitsubishi	Melsec Iq-R R32 Pcpu Firmware	<= 29
Mitsubishi	Melsec Iq-R R120 Pcpu Firmware	<= 29
Mitsubishi	Melsec Iq-R R08 Sfcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R16 Sfcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R32 Sfcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R120 Sfcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R16 Mtcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R32 Mtcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R64 Mtcpu Firmware	All versions
Mitsubishi	Melsec Iq-R R12 Ccpu-V Firmware	All versions
Mitsubishi	Melsec Q03udecpu Firmware	All versions
Mitsubishi	Melsec Q04udecpu Firmware	All versions
Mitsubishi	Melsec Q06udecpu Firmware	All versions
Mitsubishi	Melsec Q10udecpu Firmware	All versions
Mitsubishi	Melsec Q13udecpu Firmware	All versions
Mitsubishi	Melsec Q20udecpu Firmware	All versions
Mitsubishi	Melsec Q26udecpu Firmware	All versions
Mitsubishi	Melsec Q50udecpu Firmware	All versions
Mitsubishi	Melsec Q100udecpu Firmware	All versions
Mitsubishi	Melsec Q03udvcpu Firmware	All versions
Mitsubishi	Melsec Q04udvcpu Firmware	All versions
Mitsubishi	Melsec Q06udvcpu Firmware	All versions
Mitsubishi	Melsec Q13udvcpu Firmware	All versions
Mitsubishi	Melsec Q26udvcpu Firmware	All versions
Mitsubishi	Melsec Q04udpvcpu Firmware	All versions
Mitsubishi	Melsec Q06udpvcpu Firmware	All versions
Mitsubishi	Melsec Q13udpvcpu Firmware	All versions
Mitsubishi	Melsec Q26udpvcpu Firmware	All versions
Mitsubishi	Melsec Q12dccpu-V Firmware	All versions
Mitsubishi	Melsec Q24dhccpu-V\(G\) Firmware	All versions
Mitsubishi	Melsec Q24dhccpu-Ls Firmware	All versions
Mitsubishi	Melsec Q26dhccpu-Ls Firmware	All versions
Mitsubishi	Melsec Mr-Mq100 Firmware	All versions
Mitsubishi	Melsec Q172dcpu-S1 Firmware	All versions
Mitsubishi	Melsec Q173dcpu-S1 Firmware	All versions
Mitsubishi	Melsec Q172dscpu Firmware	All versions
Mitsubishi	Melsec Q173dscpu Firmware	All versions
Mitsubishi	Melsec Q170mscpu\(-S1\) Firmware	All versions
Mitsubishi	Melsec Q170mcpu Firmware	All versions

Showing 50 of 59 affected configurations. See NVD for the full list.

References

https://jvn.jp/vu/JVNVU94434051/index.htmlThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-019_en.pdfVendor Advisory
https://jvn.jp/vu/JVNVU94434051/index.htmlThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-019_en.pdfVendor Advisory

Timeline

Published: Dec 1, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-20610?

How severe is CVE-2021-20610?

CVE-2021-20610 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 3.08% probability of exploitation in the next 30 days.

How do I fix CVE-2021-20610?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-20610?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST