Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series

Vulnerability

An improper input validation vulnerability (CWE-20) exists in the FTP server component of Mitsubishi Electric GOT2000 Series GT27, GT25, and GT23 models. Affected versions are 01.39.000 and prior. The vulnerability allows a remote attacker with FTP access to send a specially crafted command, leading to a denial of service condition [1].

Exploitation

An attacker must have network access to the target GOT device's FTP server and authenticate successfully. No additional user interaction is required. By sending a specially crafted FTP command, the attacker triggers the input validation flaw, causing the FTP service to become unresponsive [1].

Impact

Successful exploitation results in a denial of service (DoS) condition, rendering the FTP server and potentially the entire GOT device unavailable until a restart [1].

Mitigation

Mitsubishi Electric has released fixed firmware version 01.47.000 for all affected models, which is bundled with GT Designer3 Version1 (GOT2000) Ver.1.285X and later. Users should update to the fixed version. As a workaround, when connecting the device to the internet, deploy a firewall to restrict access [1].