CVE-2021-20601 Business logic in GOT2000 series GT27 model; GOT2000 series GT25 model; GOT2000 series GT23 model; GOT2000 series GT21 model; GOT SIMPLE series GS21 model; GT SoftGOT2000
Remote unauthenticated attackers can bypass input validation to write out-of-range values, potentially causing device malfunction or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20601?
CVE-2021-20601 is a high-severity vulnerability in GOT2000 series GT27 model; GOT2000 series GT25 model; GOT2000 series GT23 model; GOT2000 series GT21 model; GOT SIMPLE series GS21 model; GT SoftGOT2000, published on 23 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote unauthenticated attacker to write a value that exceeds the configured input range limit by sending a malicious packet to rewrite the device value. As a result, the system operation may be affected, such as malfunction.
Weakness: CWE-20
Which versions are affected by CVE-2021-20601?
It affects 50 products.
Products include Mitsubishielectric Got2000 Gt2103-Pmbd Firmware, Mitsubishielectric Got2000 Gt2103-Pmbds2 Firmware, Mitsubishielectric Got2000 Gt2103-Pmbds Firmware, Mitsubishielectric Got2000 Gt2103-Pmbls Firmware, Mitsubishielectric Got2000 Gt2104-Rtbd Firmware, Mitsubishielectric Got2000 Gt2107-Wtbd Firmware and 44 more.
How do I fix CVE-2021-20601?
No fix has been published for CVE-2021-20601 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20601 being exploited?
There is no known exploitation of CVE-2021-20601 in the wild and no public exploit code.
Sources
Also known as GHSA-j5w5-24wj-99v2.