CVE-2021-20601

Vulnerability

An improper input validation vulnerability exists in the Mitsubishi Electric GOT2000 series (GT27, GT25, GT23, GT21 models — all versions), GOT SIMPLE series GS21 model all versions, and GT SoftGOT2000 all versions [1][2]. The product fails to validate input values against the configured range limits, allowing a remote attacker to write a value that exceeds the intended range [1][2].

Exploitation

An unauthenticated attacker with network access can send a malicious packet to the affected device [2]. The attack is remotely exploitable, requires no authentication, and has low attack complexity (AV:N/AC:L/PR:N/UI:N/S:U) [2]. No user interaction is needed [2].

Impact

Successful exploitation results in information tampering: the device value is rewritten to a value outside the configured input range limit [1][2]. This can cause the system to malfunction, potentially affecting critical manufacturing operations [2]. The CVSS v3 score is 7.5 (High), with impact on integrity (I:H) and no impact on confidentiality or availability [2].

Mitigation

As of the publication date (2021-11-23), no firmware patch is available. Mitel recommends the following workarounds: use a firewall or VPN when connecting to the Internet, restrict access to trusted networks and hosts, install antivirus on host computers, and enable the IP filter function on the GOT to limit allowable IP addresses [1][2].