High severity · published Feb 2, 2023
CVE-2022-40269
Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation…
8.1
CVSS
0.7%
EPSS
No
On KEV
Description
Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to disclose sensitive information from users' browsers or spoof legitimate users by abusing inappropriate HTML attributes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
GT Softgot2000 · Mitsubishielectric
1.265b before 1.290c · source: NVD
GF
Gt25 Firmware · Mitsubishielectric
01.14.000 before 01.48.000 · source: NVD
GF
Gt27 Firmware · Mitsubishielectric
01.14.000 before 01.48.000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40269
Third Party Advisory
https://jvn.jp/vu/JVNVU91222434/index.html
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf
More from GT Softgot2000
9.8
CVE-2020-14496
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to…
9.8
CVE-2020-14521
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability
9.8
CVE-2021-20588
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior,…
9.8
CVE-2021-20587
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions…
7.8
CVE-2024-26314
Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code