CVE-2021-20601
What it is
Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT23 model all versions, GOT2000 series GT21 model all versions, GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions allows an remote unauthenticated attacker to write a value that exceeds the configured input range limit by sending a malicious packet to rewrite the device value. As a result, the system operation may be affected, such as malfunction.
At a glance
- Exploitability
- Can be exploited over the network without logging in. High risk of data tampering.
- Exploit odds
- 2.4% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 2.4% in the next 30 days (EPSS).
- Severity: 7.5 HIGH (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 2.4% · EPSS, next 30 days
- Weakness
- CWE-20 · Improper input validation
- Record status
- Modified
Affected
- Mitsubishielectric Gt softgot2000
- Mitsubishielectric Got Simple gs2110-wtbd Firmware
- Mitsubishielectric Got Simple gs2107-wtbd Firmware
- Mitsubishielectric got2000 gt2104-rtbd Firmware
- Mitsubishielectric got2000 gt2103-pmbd Firmware
- Mitsubishielectric got2000 gt2103-pmbds Firmware
- Mitsubishielectric got2000 gt2103-pmbds2 Firmware
- Mitsubishielectric got2000 gt2103-pmbls Firmware
Attack profile CVSS 3.1 · 7.5
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2021-20601.md and follow it. Check whether this project is affected by CVE-2021-20601. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf
References
- https://jvn.jp/vu/JVNVU98072504
- https://us-cert.cisa.gov/ics/advisories/icsa-21-320-02
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf
- https://jvn.jp/vu/JVNVU98072504
- https://us-cert.cisa.gov/ics/advisories/icsa-21-320-02
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-018.pdf