Skip to main content
No exploitation reportedFix available

CVE-2021-20611

No exploitation reported by the sources we read.

  • Published2021-12-01
  • WeaknessCWE-20

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.

Timeline

dates in UTC
  1. 2021-12-0116:15CVE publishedNVD

Observed activity

isMalicious corpus · updated 2026-10-23 18:48 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2021-20611?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2021-20611?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD
Mitsubishi melsec iq-r r08 cpu firmwareversion to verify
BranchAffectedFixed in
57.x≤ 57no fix published
—all versionsno fix published
Mitsubishi melsec iq-r r120 cpu firmwareversion to verify
BranchAffectedFixed in
57.x≤ 57no fix published
—all versionsno fix published
Mitsubishi melsec iq-r r16 cpu firmwareversion to verify
BranchAffectedFixed in
57.x≤ 57no fix published
—all versionsno fix published

52 more products in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-21-334-02 CISA58 known affected

    Mitsubishi Electric MELSEC and MELIPC Series (Update G)

    MELSEC iQ-R Series R00CPU Firmware: <=24 · MELSEC iQ-R Series R01CPU Firmware: <=24 · MELSEC iQ-R Series R02CPU Firmware: <=24 · +55 more

Full record on NVD

Fix

  1. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R00CPU Firmware: Versions 25 or later
  2. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R01CPU Firmware: Versions 25 or later
  3. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R02CPU Firmware: Versions 25 or later
  4. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R04(EN)CPU Firmware: Versions 58 or later
  5. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R08(EN)CPU Firmware: Versions 58 or later
  6. Vendor fix CISA ICSA-21-334-02 · 1 productMELSEC iQ-R Series R16(EN)CPU Firmware: Versions 58 or later

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
none listed
PoC-in-GitHub

Sources

  • CNACVSS 3.17.5read 2026-10-23
  • NVDCVSS 3.17.5read 2026-10-23
  • NVDCVSS 2.07.8read 2026-10-23
  • CNAweakness (CWE)CWE-20read 2026-10-23
  • NVDweakness (CWE)CWE-20read 2026-10-23
  • FIRST EPSSEPSS score3.2 %2026-10-22

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
2021-12-01
Last Modified
2026-06-17
NVD status
Modified

Frequently asked questions

What is CVE-2021-20611?

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.

Is CVE-2021-20611 actively exploited?

Active exploitation of CVE-2021-20611 has not been confirmed. Its EPSS score was 3.2% on 2026-10-22, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-20611?

CVE-2021-20611 has a CVSS v3 base score of 7.5 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database