Mitsubishielectric vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-26314 Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code.High 7.8 · Jul 2, 2024
• CVE-2022-24946 Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q SerieHigh 7.5 · Jun 15, 2022
• CVE-2022-25161 Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or lHigh 8.6 · May 18, 2022
• CVE-2022-25159 Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F seriesHigh 8.1 · Apr 1, 2022
• CVE-2022-25158 Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F serCritical 9.1 · Apr 1, 2022
• CVE-2022-25157 Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi ElectriCritical 9.1 · Apr 1, 2022
• CVE-2022-25156 Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versionsHigh 8.1 · Apr 1, 2022
• CVE-2022-25155 Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi ElectriHigh 8.1 · Apr 1, 2022
• CVE-2021-20613 Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior, FX3U-ENET-L Firmware version 1.16 and prior and FX3U-ENET-P5High 7.5 · Jan 14, 2022
• CVE-2021-20612 Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prHigh 7.5 · Jan 14, 2022
• CVE-2021-20608 Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attHigh 7.5 · Dec 17, 2021
• CVE-2021-20601 Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versionHigh 7.5 · Nov 23, 2021
• CVE-2018-16060 Mitsubishi Electric Europe B.V.High 7.5 · Oct 15, 2021
• CVE-2021-20597 Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prCritical 9.1 · Aug 6, 2021
• CVE-2021-20594 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmwarHigh 7.5 · Aug 6, 2021
• CVE-2021-20592 Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver veHigh 7.5 · Aug 5, 2021
• CVE-2021-20596 NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware vHigh 7.5 · Jul 22, 2021
• CVE-2021-20591 Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all veHigh 7.5 · Jun 11, 2021
• CVE-2021-20590 Improper authentication vulnerability in GOT2000 series GT27 model VNC server versions 01.39.010 and prior, GOT2000 series GT25 model VNC server versions 01.39.High 7.5 · Apr 22, 2021
• CVE-2021-20586 Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-*V*D" of RV-*FR***-D-* all versions, controller "CR800-*HD" High 7.5 · Jan 29, 2021
• CVE-2020-16850 Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the networHigh 7.5 · Nov 30, 2020
• CVE-2020-12011 A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution.Critical 9.8 · Jul 16, 2020
• CVE-2020-13238 Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the networkHigh 7.5 · Jun 10, 2020
• CVE-2019-14931 An issue was discovered on Mitsubishi Electric Europe B.V.Critical 9.8 · Oct 28, 2019
• CVE-2019-14930 An issue was discovered on Mitsubishi Electric Europe B.V.Critical 9.8 · Oct 28, 2019