Vulnerability Details : CVE-2022-40266
Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 and prior allows a remote authenticated attacker to cause a Denial of Service condition by sending specially crafted command.
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2022-40266
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 47 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-40266
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.6
|
3.6
|
Mitsubishi Electric Corporation |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2022-40266
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-40266
-
https://jvn.jp/vu/JVNVU95633416
JVNVU#95633416: 三菱電機製GOT2000シリーズのFTPサーバ機能における不適切な入力確認の脆弱性Third Party Advisory
-
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-016_en.pdf
Mitigation;Vendor Advisory
Products affected by CVE-2022-40266
- cpe:2.3:o:mitsubishielectric:got2000_gt27_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishielectric:got2000_gt25_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishielectric:got2000_gt23_firmware:*:*:*:*:*:*:*:*