PT-2023-16331 · Mitsubishi · Got Simple Series Gs25+7

Hyeokjong Yun + 3 · Publicado 2023-08-03 · Atualizado 2023-08-10 · CVE-2023-0525

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior

Description The issue allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords. This can occur when transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or when transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.

Recommendations For Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior, update to a version later than 1.295H. For Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior, update to a version later than 1.295H. As a temporary workaround, consider disabling the Data Transfer Security function until a patch is available. Restrict access to the data transfer functions to minimize the risk of exploitation.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-261

Identificadores relacionados

CVE-2023-0525

Produtos afetados

Got Simple Series Gs21

Got Simple Series Gs25

Got2000 Series Gt21

Got2000 Series Gt23

Got2000 Series Gt25

Got2000 Series Gt27

Gt Designer3 Version1

Gt Softgot2000

Referências · 7

• https://t.me/cibsecurity/67740 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0525 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0525 · Nota de Segurança
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-008_en.pdf · Aviso do Fabricante
• https://jvn.jp/vu/JVNVU95285923/index.html · Nota
• https://t.me/cvenotify/56188 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-215-02 · Nota