CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-3373
https://notcve.org/view.php?id=CVE-2023-3373
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it. • https://jvn.jp/vu/JVNVU92167394/index.html https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-01 https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-006_en.pdf • CWE-330: Use of Insufficiently Random Values CWE-342: Predictable Exact Value from Previous Values •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2023-0525
https://notcve.org/view.php?id=CVE-2023-0525
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled. Vulnerabilidad Weak Encoding for Password en Mitsubishi Electric Corporation GOT2000 Series modelo GT27 versiones 01.49.000 y anteriores, modelo GT25 versiones 01.49.000 y anteriores, modelo GT23 versiones 01.49.000 y anteriores, modelo GT21 versiones 01.49.000 y anteriores, serie GOT SIMPLE modelo GS25 versiones 01.49.000 y anteriores, modelo GS21 versiones 01.49.000 y anteriores, GT Designer3 Version1 (GOT2000) versiones 1.295H y anteriores, y GT SoftGOT2000 versiones 1.295H y anteriores, permite a un atacante remoto no autenticado obtener contraseñas en texto plano al espiar paquetes que contienen contraseñas cifradas y descifrar las contraseñas cifradas. Esto ocurre en el caso de la transferencia de datos con GT Designer3 Version1 (GOT2000) y GOT2000 Series o GOT SIMPLE Series con la función de Seguridad de Transferencia de Datos habilitada, o en el caso de la transferencia de datos mediante la función de enlace SoftGOT-GOT con GT SoftGOT2000 y GOT2000 series con la función de Seguridad de Transferencia de Datos habilitada. • https://jvn.jp/vu/JVNVU95285923/index.html https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-02 https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-008_en.pdf • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •
CVSS: 9.8EPSS: 0%CPEs: 202EXPL: 0CVE-2020-16226 – Mitsubishi Electric Multiple Products
https://notcve.org/view.php?id=CVE-2020-16226
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands. Múltiples productos de Mitsubishi Electric, son vulnerables a suplantaciones de un dispositivo legítimo por parte de un actor malicioso, lo que puede permitir a un atacante ejecutar comandos arbitrarios remotamente This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mitsubishi Electric MELSEC iQ-F. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of ACK packets. When generating ACK packets, the application uses a predictable sequence number. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-20-245-01 • CWE-342: Predictable Exact Value from Previous Values •