CVE-2021-20592 Race condition in GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftGOT2000
Remote unauthenticated attackers can cause denial of service on Mitsubishi GOT HMI devices by rapidly connecting and disconnecting from the MODBUS/TCP port.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20592?
CVE-2021-20592 is a high-severity vulnerability in GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftGOT2000, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions 01.19.000 through 01.39.010 and GT SoftGOT2000 versions 1.170C through 1.256S allows a remote unauthenticated attacker to cause DoS condition on the MODBUS/TCP slave communication function of the products by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover.
Weakness: CWE-662
Which versions are affected by CVE-2021-20592?
It affects 4 products.
Products include Mitsubishielectric Got2000 Gt23 Firmware, Mitsubishielectric Got2000 Gt25 Firmware, Mitsubishielectric Got2000 Gt27 Firmware, Mitsubishielectric Gt Softgot2000.
How do I fix CVE-2021-20592?
No fix has been published for CVE-2021-20592 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20592 being exploited?
There is no known exploitation of CVE-2021-20592 in the wild and no public exploit code.
Other vulnerabilities in GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftGOT2000
Sources
Also known as GHSA-g27q-pw4h-7p4g.