Skip to content
Fencer Vulns
medium 5.9

CVE-2023-3373 json

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000…

published 2023-08-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44040

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it.

Patch / fix

  • mitsubishielectric gt21_firmware 01.50.000
  • mitsubishielectric gs21_firmware 01.50.000

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-215-01 updated cvss 5.9

Mitsubishi Electric GOT2000 and GOT SIMPLE

  • Mitsubishi Electric GOT SIMPLE, GS21 model <= 01.49.000 Mitsubishi Electric GOT2000 Series, GT21 model <= 01.49.000
    affected: vendor fix, mitigation “Mitsubishi Electric has created the following versions to fix this issue:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

  • Mitsubishi Electric Corporation GOT2000 Series GT21 model
  • Mitsubishi Electric Corporation GOT SIMPLE Series GS21 model

Classification

Weakness
  • CWE-342 Predictable Exact Value from Previous Values
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.