Medium severity · published Nov 24, 2022
CVE-2022-40266
Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP…
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 and prior allows a remote authenticated attacker to cause a Denial of Service condition by sending specially crafted command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GG
Got2000 Gt23 Firmware · Mitsubishielectric
through 01.39.000 · source: NVD
GG
Got2000 Gt25 Firmware · Mitsubishielectric
through 01.39.000 · source: NVD
GG
Got2000 Gt27 Firmware · Mitsubishielectric
through 01.39.000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40266
Third Party Advisory
https://jvn.jp/vu/JVNVU95633416
Mitigation
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-016_en.pdf
More from Got2000 Gt23 Firmware
7.5
CVE-2021-20592
Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000…