Vulnerability · Published Nov 23, 2021 · Assigned by Mitsubishi

CVE-2021-20601

High 7.5

In plain English

A high-severity security flaw in GOT2000 series GT27 model; GOT2000 series GT25 model; GOT2000 series GT23 model; GOT2000 series GT21 model; GOT SIMPLE series GS21 model; GT SoftGOT2000. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.4%top 15.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote unauthenticated attacker to write a value that exceeds the configured input range limit by sending a malicious packet to rewrite the device value. As a result, the system operation may be affected, such as malfunction.

Affected products (as reported)

Vendor	Product	Versions
n/a	GOT2000 series GT27 model; GOT2000 series GT25 model; GOT2000 series GT23 model; GOT2000 series GT21 model; GOT SIMPLE series GS21 model; GT SoftGOT2000	All versions

References

https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf x_refsource_MISC
https://jvn.jp/vu/JVNVU98072504 x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-21-320-02 x_refsource_MISC