Missing synchronization vulnerability in GOT2000 series GT27 model communication driver…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions 01.19.000 through 01.39.010 and GT SoftGOT2000 versions 1.170C through 1.256S allows a remote unauthenticated attacker to cause DoS condition on the MODBUS/TCP slave communication function of the products by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftGOT2000 | communication driver versions 01.19.000 through 01.39.010; versions 1.170C through 1.256S | — | No fix listed | CNA |
- GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftGOT2000 Vendor— Affected communication driver versions 01.19.000 through 01.39.010; versions 1.170C through 1.256S Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* | 1.170c – 1.256s | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:o:mitsubishielectric:got2000_gt27_firmware:*:*:*:*:*:*:*:* | 01.19.000 – 01.39.010 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt27:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
| cpe:2.3:o:mitsubishielectric:got2000_gt25_firmware:*:*:*:*:*:*:*:* | 01.19.000 – 01.39.010 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
| cpe:2.3:o:mitsubishielectric:got2000_gt23_firmware:*:*:*:*:*:*:*:* | 01.19.000 – 01.39.010 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt23:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* Versions 1.170c – 1.256s Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:o:mitsubishielectric:got2000_gt27_firmware:*:*:*:*:*:*:*:* Versions 01.19.000 – 01.39.010 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt27:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
- cpe:2.3:o:mitsubishielectric:got2000_gt25_firmware:*:*:*:*:*:*:*:* Versions 01.19.000 – 01.39.010 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
- cpe:2.3:o:mitsubishielectric:got2000_gt23_firmware:*:*:*:*:*:*:*:* Versions 01.19.000 – 01.39.010 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt23:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20592
- 2026-10-03 Alias added: GHSA-g27q-pw4h-7p4g
References
More Mitsubishi Electric Europe B.V. Got2000 Gt23 Firmware vulnerabilities
- TI-2022-19112 Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-20592 · CVE Program
- CVE-2021-20592 · NVD
- FIRST EPSS
- GHSA-g27q-pw4h-7p4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences