Is CVE-2021-20599 actively exploited?

No active exploitation of CVE-2021-20599 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-20599 be exploited remotely?

Yes. CVE-2021-20599 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-20599?

CVE-2021-20599 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-20599

HIGH

CVE-2021-20599

CWE-319Published: October 14, 2021· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

NVD Source

Technical Analysis

CVE-2021-20599 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

mitsubishielectric16 product(s)

r08sfcpu firmwarer08sfcpur16sfcpu firmwarer16sfcpur32sfcpu firmwarer32sfcpur120sfcpu firmwarer120sfcpur08psfcpu firmwarer08psfcpur16psfcpu firmwarer16psfcpu+4

Source: NVD CPE · 16 total CPE entries