High severity · published Nov 23, 2021
CVE-2021-20601
Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series…
7.5
CVSS
2.4%
EPSS
No
On KEV
Description
Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote unauthenticated attacker to write a value that exceeds the configured input range limit by sending a malicious packet to rewrite the device value. As a result, the system operation may be affected, such as malfunction.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
GT Softgot2000 · Mitsubishielectric
All versions, or not specified · source: NVD
GS
Got Simple Gs2107-wtbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GS
Got Simple Gs2110-wtbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2103-pmbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2103-pmbds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2103-pmbds2 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2103-pmbls Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2104-rtbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2107-wtbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2308-vtba Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2308-vtbd Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
GG
Got2000 Gt2310-vtba Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
Affected product
GS
Got Simple Gs2107-wtbd Firmware
Mitsubishielectric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20601
Third Party Advisory
https://jvn.jp/vu/JVNVU98072504
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-320-02
Vendor Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf
