CVE-2023-3373 - Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it

Back Back to CVE browser

CRITICAL

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it

Published Aug 3, 2023

9.1

CRITICAL

CVSS 3.1

EPSS 1.02%

Description

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it.

Affected products

Vendor Mitsubishi Electric Corporation Product GOT SIMPLE Series GS21 model Default
unaffected
- Version
  01.49.000 and prior
  Status
  affected
  Constraints
  -
Vendor Mitsubishi Electric Corporation Product GOT2000 Series GT21 model Default
unaffected
- Version
  01.49.000 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mitsubishi Electric Corporation

GOT SIMPLE Series GS21 model

unaffected

Version	Status	Constraints
01.49.000 and prior	affected	-

Mitsubishi Electric Corporation

GOT2000 Series GT21 model

unaffected

Version	Status	Constraints
01.49.000 and prior	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-330

Insufficient Randomness

CWE-342

References (3)

https://jvn.jp/vu/JVNVU92167394/index.html
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-01
Third Party AdvisoryUS Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-006_en.pdf
Vendor Advisory

Link	Providers	Tags
https://jvn.jp/vu/JVNVU92167394/index.html		Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-01		Third Party AdvisoryUS Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-006_en.pdf		Vendor Advisory