Security readout for executives and security teams
Plain-English summary
This issue can let an unauthenticated remote actor tie up the MELSOFT TCP/IP connection path on affected Mitsubishi MELSEC iQ-R CPU modules by leaving connections open. The business risk is loss of legitimate engineering or management connectivity, which can disrupt operations or delay response during an incident.
Executive priority
Treat this as an OT availability risk. Prioritize exposed or poorly segmented PLC networks first, especially environments where loss of engineering connectivity would affect production, safety response, or incident recovery.
Technical view
CVE-2021-20591 is an uncontrolled resource consumption flaw affecting listed MELSEC iQ-R CPU modules across all stated versions. The reported impact is denial of service against legitimate clients connecting to the MELSOFT transmission port over TCP/IP when a connection is not closed properly.
Likely exposure
Exposure is most likely where affected MELSEC iQ-R CPU modules have the MELSOFT transmission port reachable from untrusted, flat, or poorly segmented networks. Internet exposure is not stated in the sources.
Exploitation context
The source bundle does not cite active exploitation, public exploit tooling, or CISA KEV inclusion. The described attack is remote and unauthenticated, but the available evidence only supports denial of service against MELSOFT client connectivity.
Researcher notes
The provided data lacks CVSS, CWE, detailed fix information, and proof of exploitation. Analysis should remain bounded to unauthenticated resource exhaustion causing MELSOFT transmission port denial of service on the listed MELSEC iQ-R CPU modules.
Mitigation direction
- Review Mitsubishi Electric PSIRT advisory 2021-003 for vendor-specific remediation guidance.
- Restrict MELSOFT transmission port access to authorized engineering workstations only.
- Segment PLC networks from enterprise, guest, and internet-facing networks.
- Monitor for unusual long-lived or abandoned connections to affected CPU modules.
- Apply vendor-recommended updates or configuration changes if listed in the advisory.
Validation and detection
- Inventory MELSEC iQ-R CPU module models and versions against the affected list.
- Confirm MELSOFT TCP/IP access is limited by firewall or ACL policy.
- Check whether any affected modules are reachable from untrusted network zones.
- Review logs or monitoring for abnormal connection persistence to PLC communication services.
- Verify remediation status against Mitsubishi Electric and JVN advisory records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-20591 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-003_en.pdfCVE reference · x_refsource_MISC
- https://jvn.jp/vu/JVNVU98060539/index.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.