CVE-2022-40269

EUVD-2022-43567
Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to disclose sensitive information from users' browsers or spoof legitimate users by abusing inappropriate HTML attributes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
MitsubishiCNA
6.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
mitsubishielectricgt_softgot2000
1.265b ≤
𝑥
< 1.290c
mitsubishielectricgt27_firmware
01.14.000 ≤
𝑥
< 01.48.000
mitsubishielectricgt25_firmware
01.14.000 ≤
𝑥
< 01.48.000
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jvn.jp/vu/JVNVU91222434/index.html
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf
https://jvn.jp/vu/JVNVU91222434/index.html
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf