Loading story…
CISA issued advisories for multiple vulnerabilities in Mitsubishi Electric GOT2000 and GOT SIMPLE human-machine interfaces that affect the devices' built-in FTP server function. One flaw, CVE-2022-40266, is an improper input validation issue in GOT2000 Series GT27, GT25, and GT23 models that can let an authenticated low-privilege attacker send a specially crafted command and trigger a denial-of-service condition. A second flaw, CVE-2023-3373 (CWE-342), affects GOT2000 Series GT21 and GOT SIMPLE GS21 devices, where predictable FTP data connection port values could enable denial of service or spoofing through session hijacking.
Mitsubishi Electric said affected FTP server versions include 01.39.000 and earlier for the first issue and 01.49.000 and earlier for the second, with fixes available in 01.47.000+ and 01.50.000+ respectively. CISA reported both vulnerabilities as remotely exploitable with no known public exploits and urged operators to update affected systems, disable the FTP server function if it is unnecessary, and apply industrial control system hardening measures such as isolating control networks, blocking untrusted access, using VPNs for remote connectivity, enforcing IP filtering, and avoiding direct Internet exposure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CISA released ICS advisory ICSA-23-215-01 for CVE-2023-3373, a remotely exploitable FTP server weakness in Mitsubishi Electric GOT2000 and GOT SIMPLE products. The advisory noted no known public exploits and recommended upgrading, restricting access, and disabling FTP if unnecessary.
Mitsubishi Electric addressed a predictable FTP data connection port vulnerability affecting GOT2000 Series GT21 and GOT SIMPLE GS21 devices, which could enable denial of service or spoofing via session hijacking. The issue affected version 01.49.000 and earlier, with version 01.50.000 or later listed as fixed.
CISA issued ICS advisory ICSA-22-333-01 covering CVE-2022-40266 in Mitsubishi Electric GOT2000 Series devices. The advisory said the vulnerability was remotely exploitable, affected availability, and had no known public exploits at the time of publication.
Mitsubishi Electric identified an improper input validation flaw in the GOT2000 Series FTP server affecting GT27, GT25, and GT23 models, where an authenticated low-privilege attacker could trigger a denial of service with a crafted command. The company advised updating affected FTP server software from version 01.39.000 and earlier to version 01.47.000 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued updated advisories for multiple **Mitsubishi Electric** industrial control system products used in the **Critical Manufacturing** sector, detailing vulnerabilities that could let remote attackers disrupt operations, impersonate trusted devices, or execute malicious code. The most severe issue, `CVE-2023-3346`, is a critical classic buffer overflow in numerous Mitsubishi Electric **CNC Series** products with a **CVSS v3 9.8** score; CISA said specially crafted packets could trigger denial of service and enable unauthenticated remote code execution, with some affected systems requiring a reset to recover. Separate advisories also covered `CVE-2020-16226`, a predictable-value weakness affecting a broad range of Mitsubishi Electric automation products that could allow device impersonation, TCP session hijacking, and possible remote command execution, and two flaws in **CC-Link IE TSN Industrial Managed Switch** models `NZ2MHG-TSNT8F2` and `NZ2MHG-TSNT4`: `CVE-2022-4304`, an observable timing discrepancy that may disclose information via crafted packets, and `CVE-2022-4450`, a double-free bug that could cause denial of service through a malicious certificate import. Mitsubishi Electric has released firmware or fixed versions for affected products and urged operators to upgrade, segment control networks, limit internet exposure, and use firewalls or VPNs for remote access; CISA said it had **no evidence of public exploitation** targeting these flaws at the time of publication.
Jun 29, 2026
CISA issued multiple advisories covering vulnerabilities in Mitsubishi Electric industrial control system products, including **MELFA SD/SQ and F-series robot controllers**, **MELSEC iQ-F**, **iQ-R**, **Q**, **L series**, and **MELIPC** platforms. The most severe issues included remotely exploitable authentication weaknesses in factory automation devices and an authentication bypass in robot controllers caused by active debug code, tracked as `CVE-2022-33323`, which could permit unauthorized telnet access. Other flaws, including `CVE-2022-25155` through `CVE-2022-25160`, involved weak or improper authentication handling, cleartext storage of sensitive information, and capture-replay abuse that could let unauthenticated attackers log in, disclose data, tamper with product information, or impersonate legitimate users. A separate advisory also warned that multiple Intel third-party component vulnerabilities affected Mitsubishi Electric factory automation products, creating risks including privilege escalation, parameter disclosure, and denial of service, with a worst-case **CVSS v3 8.8**. Mitsubishi Electric released firmware updates or mitigation guidance and directed customers to vendor bulletins and Intel advisories where applicable. CISA urged operators to limit network exposure, isolate control systems from business networks, use firewalls or VPNs for remote access, restrict physical access where relevant, and follow standard ICS hardening practices. The advisories said no known public exploits were specifically targeting these vulnerabilities at the time of publication.
Jun 29, 2026
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026