CVEs-PoC/2021/CVE-2021-20598.md

### [CVE-2021-20598](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20598)
![](https://img.shields.io/static/v1?label=Product&message=MELSEC%20iQ-R%20series%20CPU%20modules%20R08%2F16%2F32%2F120SFCPU%3B%20R08%2F16%2F32%2F120PSFCPU&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=all%20versions%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Overly%20Restrictive%20Account%20Lockout%20Mechanism&color=brightgreen)

### Description

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to lockout a legitimate user by continuously trying login with incorrect password.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/NozomiNetworks/blackhat23-melsoft