CVE:CVE-2021-20597
CNNVD:CNNVD-202108-679
Mitsubishi Electric MELSEC iQ-R series是日本三菱电机（Mitsubishi Electric）公司的一款可编程逻辑控制器。
Mitsubishi Electric MELSEC iQ-R 系列产品存在访问控制错误漏洞，该漏洞源于产品未对凭证添加有效的保护机制，攻击者可通过用户注册、更改密码时通过嗅探工具获得凭证从而未经授权的登录到目标。以下产品及版本受到影响：Mitsubishi Electric MELSEC iQ-R R08/16/32/120SFCPU 所有固件版本，Mitsubishi Electric MELSEC iQ-R R08/16/32/120PSFCPU 所有固件版本。
solution:Upgrade mitsubishielectric r08sfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r16sfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r32sfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r120sfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r08psfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r16psfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r32psfcpu_firmware to a higher version than *; Upgrade mitsubishielectric r120psfcpu_firmware to a higher version than *