PT-2023-16331 · Mitsubishi · Got Simple Series Gs25+7

Hyeokjong Yun + 3 · Published 2023-08-03 · Updated 2023-08-10 · CVE-2023-0525

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior

Description The issue allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords. This can occur when transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or when transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.

Recommendations For Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior, update to a version later than 1.295H. For Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior, update to a version later than 1.295H. As a temporary workaround, consider disabling the Data Transfer Security function until a patch is available. Restrict access to the data transfer functions to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-261

Related Identifiers

CVE-2023-0525

Affected Products

Got Simple Series Gs21

Got Simple Series Gs25

Got2000 Series Gt21

Got2000 Series Gt23

Got2000 Series Gt25

Got2000 Series Gt27

Gt Designer3 Version1

Gt Softgot2000

References · 7

• https://osv.dev/vulnerability/CVE-2023-0525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0525 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-008_en.pdf · Vendor Advisory
• https://t.me/cibsecurity/67740 · Telegram Post
• https://jvn.jp/vu/JVNVU95285923/index.html · Note
• https://t.me/cvenotify/56188 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-215-02 · Note