CVE-2023-3373
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The CVE-2023-3373 vulnerability in the GT21 and GS21 models of the GOT2000 and GOT SIMPLE series allows a remote unauthenticated attacker to hijack data connections or prevent legitimate users from establishing connections by guessing the listening port on the FTP server.
Risk Assessment
The organization may be exposed to session hijacking attacks and DoS attacks, potentially leading to system disruptions and data loss.
Recommendation
It is recommended to update the software to the latest version and implement additional security measures to minimize the risk of attacks.
Original NVD description (English source)
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it.