dbcve.org
C Controller Module Setting And Monitoring ToolPlugin / extension · Mitsubishielectric

CVE-2021-20588

CRITICAL · 9.8 CVSS v3.1 Published 2021-02-19
Fix available
A fix is available. Upgrade to after 3.44w or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 versions 1.24A and prior, GT Designer3 Version1(GOT1000) versions 1.250L and prior, GT Designer3 Version1(GOT2000) versions 1.250L and prior, GT SoftGOT1000 Version3 versions 3.245F and prior, GT SoftGOT2000 Version1 versions 1.250L and prior, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer versions 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer versions 1.115U and prior, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) versions 1.003D and prior, iQ Monozukuri Process Remote Monitoring (Data Transfer) versions 1.002C and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link versions 1.03D and prior, MELFA-Works versions 4.4 and prior, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) versions 1.015R and prior, MELSOFT Navigator versions 2.74C and prior, MH11 SettingTool Version2 versions 2.004E and prior, MI Configurator versions 1.004E and prior, MT Works2 versions 1.167Z and prior, MX Component versions 5.001B and prior, Network Interface Board CC IE Control utility versions 1.29F and prior, Network Interface Board CC IE Field Utility versions 1.16S and prior, Network Interface Board CC-Link Ver.2 Utility versions 1.23Z and prior, Network Interface Board MNETH utility versions 34L and prior, PX Developer versions 1.53F and prior, RT ToolBox2 versions 3.73B and prior, RT ToolBox3 versions 1.82L and prior, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) versions 4.12N and prior, and SLMP Data Collector versions 1.04E and prior) allows a remote unauthenticated attacker to cause a DoS condition on the software products, and possibly to execute a malicious code on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Improper Handling of Length Parameter Inconsistency in multiple Mitsubishi Electric FA engineering software products. Remote unauthenticated attackers can spoof MELSEC, GOT or FREQROL devices and send crafted reply packets with malformed length parameters, causing DoS and potentially remote code execution on engineering workstations.

MitigationUpdate all affected software to versions newer than those listed as vulnerable; isolate engineering workstations on dedicated network segments; implement device authentication to prevent spoofing attacks.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
C Controller Module Setting And Monitoring ToolPlugin / extension
Affected:all versions
Cpu Module Logging Configuration ToolPlugin / extension
Affected:<= 1.112r
Cw ConfiguratorApplication
Affected:<= 1.011m
Data TransferApplication
Affected:<= 3.44w
EzsocketApplication
Affected:all versions
Fr ConfiguratorApplication
Affected:all versions
Fr Configurator Sw3Application
Affected:all versions
Fr Configurator2Application
Affected:<= 1.24a

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Mitsubishi engineering software
    Check system for presence of any of these affected products: C Controller Module Setting And Monitoring Tool, Cpu Module Logging Configuration Tool, Cw Configurator, Data Transfer, Ezsocket, FR Configurator, FR Configurator SW3, or FR Configurator2. Inspect typical installation directories (Program Files, Program Files (x86) on Windows) or use system inventory tools.
    Affected if Any of the eight affected products is installed on the system
  2. Determine installed version of affected software
    For each identified Mitsubishi product, locate its version information. Common methods: check Help > About dialog, right-click executable and view Properties > Details, check Windows Registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, or check version info in the software's installation folder.
    Affected if Version is at or below 1.112m for Cpu Module Logging Configuration Tool, at or below 1.011m for Cw Configurator, at or below 3.44w for Data Transfer, at or below 1.24a for FR Configurator2, or is any version for products listed as 'all versions' (C Controller Module Setting And Monitoring Tool, Ezso
  3. Verify if software connects to MELSEC, GOT or FREQROL devices
    Examine the software's configuration files, connection settings, or device definitions. Look for configured device connections, saved station numbers, or network settings within the application. Check project files for device definitions.
    Affected if Software is configured with connections to MELSEC, GOT or FREQROL devices on the network
  4. Assess network exposure of the engineering software
    Review network configuration and firewall rules for the workstation. Check if the software opens listening ports or communicates on industrial protocol ports (common ports: 5000-5002, 5007, 5011, 9626 for Mitsubishi protocols). Use netstat or equivalent to identify listening ports.
    Affected if The workstation has the affected software exposed on the network with open ports for device communications

A system is affected if any of the eight Mitsubishi engineering software products is installed and is configured to communicate with MELSEC, GOT or FREQROL devices on a network where spoofed device replies could be received.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 3.44w
Interim mitigation

Update all affected software to versions newer than those listed as vulnerable; isolate engineering workstations on dedicated network segments; implement device authentication to prevent spoofing attacks.

Recommended fix Moderate confidence

Obtain product-specific fixed versions from Mitsubishi Electric security advisory (e.g., CW Configurator > 1.011M, Data Transfer > 3.44W, FR Configurator2 > 1.24A, CPU Module Logging Configuration Tool > 1.112R). Contact Mitsubishi Electric technical support for exact version numbers and download li

  1. 1. Identify the specific Mitsubishi Electric FA Engineering Software product(s) in use from the affected products list.
  2. 2. For each affected product, obtain the fixed version from Mitsubishi Electric's official security advisory or contact Mitsubishi Electric technical support.
  3. 3. Download the updated version of the software from Mitsubishi Electric's official website or authorized distribution channel.
  4. 4. Before deploying the update, review the release notes for any changes that might affect your existing projects or configurations.
  5. 5. Create a backup of current project files, configurations, and settings.
  6. 6. Uninstall the current version of the affected software.
  7. 7. Install the fixed version of the software.
  8. 8. Re-apply any necessary configurations and verify the software functions correctly with your existing projects.
Caveat Review release notes for each product upgrade as configuration or project file changes may occur. Test thoroughly in non-production environment before deploying to production.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in C Controller Module Setting And Monitoring Tool Scoped from the published advisory
  • Consultation8.0 h
  • Implementation16.0 h
  • Testing12.0 h
  • Review / QA8.0 h
44.0 hours of engineering $7,720
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-20588 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-20588 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data