PT-2021-14064 · Mitsubishi · Got2000 Series Gt27+3
Published
2021-08-05
·
Updated
2021-08-27
·
CVE-2021-20592
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010
GOT2000 series GT25 model communication driver versions 01.19.000 through 01.39.010
GOT2000 series GT23 model communication driver versions 01.19.000 through 01.39.010
GT SoftGOT2000 versions 1.170C through 1.256S
Description:
A missing synchronization issue in the communication driver allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition on the MODBUS/TCP slave communication function by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover.
Recommendations:
For GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, update to a version outside of this range to resolve the issue.
For GOT2000 series GT25 model communication driver versions 01.19.000 through 01.39.010, update to a version outside of this range to resolve the issue.
For GOT2000 series GT23 model communication driver versions 01.19.000 through 01.39.010, update to a version outside of this range to resolve the issue.
For GT SoftGOT2000 versions 1.170C through 1.256S, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to the MODBUS/TCP communication port to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Got2000 Series Gt23
Got2000 Series Gt25
Got2000 Series Gt27
Gt Softgot2000