Read the docs
TI-2023-00496 Aliases CVE-2023-0525GHSA-g862-3pqw-c5wx

Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000…

Priority LOW 34CWE-261Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00682 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mitsubishi Electric CorporationGOT2000 Series GT27 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGOT2000 Series GT25 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGOT2000 Series GT23 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGOT2000 Series GT21 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGOT SIMPLE Series GS25 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGOT SIMPLE Series GS21 modelup to 01.49.000—No fix listedCNA
Mitsubishi Electric CorporationGT Designer3 Version1 (GOT2000)up to 1.295H—No fix listedCNA
Mitsubishi Electric CorporationGT SoftGOT2000up to 1.295H—No fix listedCNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:*before 1.300nVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:*before 1.300nVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:gt27_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gt27:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:gt25_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gt25:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:gt23_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gt23:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:gt21_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gt21:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:mitsubishielectric:gs25_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gs25:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:gs21_firmware:*:*:*:*:*:*:*:*before 01.50.000VulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:gs21:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0525
  2. 2026-10-03 Alias added: GHSA-g862-3pqw-c5wx

References

Advisory 3

  • TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
  • TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
  • TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
  • TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
  • TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
  • TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences