CVE-2022-40269

Vulnerability

An authentication bypass by spoofing vulnerability (CWE-290) exists in the GOT Mobile function of Mitsubishi Electric GOT2000 Series GT27 and GT25 models (versions 01.14.000 to 01.47.000) and GT SoftGOT2000 (versions 1.265B to 1.285X). The flaw arises from inappropriate control of HTML attributes, allowing an attacker to craft a malicious page that mimics the legitimate GOT Mobile interface [1].

Exploitation

A remote unauthenticated attacker can exploit this weakness by luring a user who has the GOT Mobile function enabled to visit a specially crafted web page. The attacker does not need prior network access to the GOT device; instead, they abuse improper HTML attribute handling to execute a spoofing attack [1].

Impact

Successful exploitation can lead to disclosure of sensitive information from the victim's web browser (such as cookies or session tokens) and impersonation of legitimate users, enabling further unauthorized actions within the GOT Mobile environment [1].

Mitigation

Mitsubishi Electric has released updated firmware for the affected products; users should upgrade to the latest versions specified in the vendor advisory. For GOT2000 Series, versions after 01.47.000 are fixed; GT SoftGOT2000 users should update to a version later than 1.285X. Refer to vendor documentation for version confirmation and update procedures [1].