Multiple vulnerabilities in Mitsubishi Electric GOT2000 Series and GT SoftGOT2000



Published: 2023-02-03
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2022-40269
CVE-2022-40268
CWE-ID CWE-290
CWE-1021
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
GOT2000 GT27 model
Server applications / SCADA systems

GOT2000 GT25 model
Server applications / SCADA systems

GT SoftGOT2000
Server applications / SCADA systems

Vendor Mitsubishi Electric

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Authentication Bypass by Spoofing

EUVDB-ID: #VU71793

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40269

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can impersonate legitimate users by abusing inappropriate HTML attributes or cause users' browsers to disclose sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GOT2000 GT27 model: 01.14.000 - 01.47.000

GOT2000 GT25 model: 01.14.000 - 01.47.000

GT SoftGOT2000: 1.265B - 1.285X

External links

http://jvn.jp/vu/JVNVU91222434/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Restriction of Rendered UI Layers or Frames

EUVDB-ID: #VU71794

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40268

CWE-ID: CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper restriction of rendered UI layers or frames. A remote attacker can trick a victim to perform unintended operations through clickjacking.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GOT2000 GT27 model: 01.14.000 - 01.47.000

GOT2000 GT25 model: 01.14.000 - 01.47.000

GT SoftGOT2000: 1.265B - 1.285X

External links

http://jvn.jp/vu/JVNVU91222434/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###