CVE-2021-32998 is an out-of-bounds write vulnerability (CWE-787) in the firmware of FANUC R-30iA and R-30iB series industrial robot controllers: a remote attacker who can reach the controller's network interface may be able to trigger the memory-safety flaw and execute arbitrary code on the device, and both NVD and CISA's coordinated advisory rate the issue 7.4 (high) on the CVSS v3.1 scale, noting the attack requires high complexity and is not known to have been exploited.
Vulnerability summary
7.4
High
1.3%
EPSS score (FIRST)
No
CISA KEV catalog
2022-01-10
Published
Vulnerability ID: CVE-2021-32998 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| FANUC R-30iA and R-30iB series industrial robot controllers | — | R-30iA/R-30iA Mate (v7 series) v7.20, v7.30, v7.40, v7.43, v7.50, v7.63, v7.70; R-30iB/R-30iB Mate/Compact (v8 series) v8.10, v8.13, v8.20, v8.23, v8.26, v8.30, v8.33, v8.36; R-30iB Plus (v9 series) v9.10, v9.13, v9.16, v9.30, v9.36, v9.40, per CISA advisory ICSA-21-243-02 |
What does this mean for affected devices?
CVE-2021-32998 (CWE-787, out-of-bounds write) affects the controller firmware used in FANUC industrial robot arms. NVD's description states: "The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code" (NVD).
CISA's coordinated advisory ICSA-21-243-02, "FANUC Robot Controllers," lists the affected firmware as R-30iA/R-30iA Mate v7 series (v7.20 through v7.70), R-30iB/R-30iB Mate/Compact v8 series (v8.10 through v8.36), and R-30iB Plus v9 series (v9.10 through v9.40). It was published alongside a companion integer-coercion crash bug, CVE-2021-32996, affecting the same controller lines. CISA notes no public exploits are known and recommends configuring FANUC Server Access Control (FSAC) to restrict webserver access by IP, using Network Protocol Access Level settings to close unneeded ports, placing control networks and remote devices behind firewalls isolated from the business network, and using VPNs for any required remote access (CISA ICSA-21-243-02).
NVD and the CISA-coordinated metric both score the flaw CVSS v3.1 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H — network-reachable but with high attack complexity, no privileges or user interaction required (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01259 (69.8th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
FANUC's R-30i series controllers drive industrial robot arms on factory floors. Operators running an affected firmware version should apply FANUC's recommended network-access controls and keep the controller off any network reachable from the business LAN or internet until an update is applied.
Evidence
- The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. — NVD
- Affects R-30iA/R-30iA Mate v7 series (v7.20-v7.70), R-30iB/R-30iB Mate/Compact v8 series (v8.10-v8.36), and R-30iB Plus v9 series (v9.10-v9.40); mitigations include FSAC IP restriction, closing unneeded ports, and network isolation. — CISA ICS Advisory ICSA-21-243-02
- CVSS v3.1 base score 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, scored identically by NVD and the CISA-coordinated metric. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01259 (69.8th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
