dbcve.org
Gx Works2Application · Mitsubishielectric

CVE-2021-20608

HIGH · 7.5 CVSS v3.1 Published 2021-12-17
Fix available
A fix is available. Upgrade to after 1.606g or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A length parameter inconsistency vulnerability in Mitsubishi Electric GX Works2 (versions 1.606G and prior) allows a remote unauthenticated attacker to cause denial of service by sending malicious crafted packets that tamper with a program file on a connected PLC. When GX Works2 reads the tampered file, it triggers a DoS condition due to improper handling of the inconsistent length parameter.

MitigationUpdate GX Works2 to a version beyond 1.606G once the vendor releases a patch. Additionally, implement network segmentation between engineering workstations and PLCs, and restrict unauthorized access to the PLC communication network to reduce the attack surface.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Gx Works2Application
Affected:<= 1.606g

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if GX Works2 is installed
    Check the system for Mitsubishi Electric GX Works2 installation. On Windows, this can be done via Add or Remove Programs, Program Files directory, or by searching for 'GX Works2' in the Start menu or file system.
    Affected if GX Works2 software is found on the system
  2. Determine the installed GX Works2 version
    Locate the GX Works2 executable (typically in the installation directory such as C:\Program Files\Mitsubishi Electric\GX Works2\) and view its file properties, or access the version information through the application's About/Help menu.
    Affected if Unable to determine the version number for comparison
  3. Compare version to affected range
    Compare the installed version against the affected range: versions 1.606G and prior. Version 1.606G itself is also affected. If the version is lower than or equal to 1.606G (for example, 1.606G, 1.605, 1.600, etc.), the installation is vulnerable.
    Affected if Installed version is 1.606G or any prior version (e.g., 1.600, 1.500, etc.)
  4. Assess exposure to tampered PLC program files
    Determine if GX Works2 is used to open or read program files from PLCs or network locations where tampering could occur. The DoS triggers specifically when GX Works2 reads a maliciously tampered program file.
    Affected if GX Works2 is used to open program files from shared or unprotected PLC communication networks

A system is affected if GX Works2 version 1.606G or prior is installed and is used to read program files, as the DoS condition triggers when reading tampered files.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 1.606g
Interim mitigation

Update GX Works2 to a version beyond 1.606G once the vendor releases a patch. Additionally, implement network segmentation between engineering workstations and PLCs, and restrict unauthorized access to the PLC communication network to reduce the attack surface.

Recommended fix Moderate confidence

GX Works2 version higher than 1.606G (contact Mitsubishi Electric for exact latest stable release)

  1. Check your current GX Works2 version by opening the software and navigating to the Help > Version Information menu
  2. Download the latest version of GX Works2 from the official Mitsubishi Electric website (www.mitsubishielectric.com) or your authorized distributor
  3. Before upgrading, backup all current projects and program files
  4. Close GX Works2 and any running Mitsubishi Electric software
  5. Run the installer for the new version and follow the installation wizard prompts
  6. After installation, verify the version shows as newer than 1.606G in Help > Version Information
  7. Test that project files open correctly and PLC connections work as expected

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Gx Works2 Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing2.0 h
  • Review / QA1.0 h
6.0 hours of engineering $1,060
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,696.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-20608 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-20608 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data