Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 and prior allows a remote authenticated attacker to cause a Denial of Service condition by sending specially crafted command.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00894 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | GOT2000 Series GT27 model | FTP server versions 01.39.000 and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GOT2000 Series GT25 model | FTP server versions 01.39.000 and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GOT2000 Series GT23 model | FTP server versions 01.39.000 and prior | — | No fix listed | CNA |
- GOT2000 Series GT27 model VendorMitsubishi Electric Corporation Affected FTP server versions 01.39.000 and prior Fixed in — No fix listed CNA
- GOT2000 Series GT25 model VendorMitsubishi Electric Corporation Affected FTP server versions 01.39.000 and prior Fixed in — No fix listed CNA
- GOT2000 Series GT23 model VendorMitsubishi Electric Corporation Affected FTP server versions 01.39.000 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mitsubishielectric:got2000_gt27_firmware:*:*:*:*:*:*:*:* | up to 01.39.000 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt27:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
| cpe:2.3:o:mitsubishielectric:got2000_gt25_firmware:*:*:*:*:*:*:*:* | up to 01.39.000 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
| cpe:2.3:o:mitsubishielectric:got2000_gt23_firmware:*:*:*:*:*:*:*:* | up to 01.39.000 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:got2000_gt23:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi Electric Europe B.V. |
- cpe:2.3:o:mitsubishielectric:got2000_gt27_firmware:*:*:*:*:*:*:*:* Versions up to 01.39.000 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt27:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
- cpe:2.3:o:mitsubishielectric:got2000_gt25_firmware:*:*:*:*:*:*:*:* Versions up to 01.39.000 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
- cpe:2.3:o:mitsubishielectric:got2000_gt23_firmware:*:*:*:*:*:*:*:* Versions up to 01.39.000 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:got2000_gt23:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40266
- 2026-10-03 Alias added: GHSA-7mj5-7wjc-fw8c
References
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-40266 · CVE Program
- CVE-2022-40266 · NVD
- FIRST EPSS
- GHSA-7mj5-7wjc-fw8c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences