Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-0525 — gs21-firmware

🟠 CVSS 7.5 — High ✅ No Known Exploit CWE-261 NVD
7.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity none, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Attack vector: Network — reachable from anywhere that can route to the service.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: None — an unauthenticated stranger can try it.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: High — total loss, or loss the attacker controls.
  • Integrity impact: None.
  • Availability impact: None.

Weakness class

CVE-2023-0525 is classified as CWE-261: Weak Encoding for Password. Obscuring a password with a trivial encoding does not protect the password.

Affected software

CVE-2023-0525 is recorded against 8 packages.

  • gs21-firmware (fixed in 01.50.000)
  • gs25-firmware (fixed in 01.50.000)
  • gt-designer3 (fixed in 1.300n)
  • gt-softgot2000 (fixed in 1.300n)
  • gt21-firmware (fixed in 01.50.000)
  • gt23-firmware (fixed in 01.50.000)
  • gt25-firmware (fixed in 01.50.000)
  • gt27-firmware (fixed in 01.50.000)

Timeline and source

Published on 4 August 2023 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

jvn.jp
www.cisa.gov
www.mitsubishielectric.com
jvn.jp
www.cisa.gov
www.mitsubishielectric.com

Other advisories for this package

gs21-firmware has other advisories on record. If you are patching this one, these are worth checking on the same host:

Same weakness in other software

These advisories are the same class of weakness (CWE-261: Weak Encoding for Password) in other software:

Details

Severity HIGH
CVSS Score 7.5
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE CWE-261
Public Exploit ✅ No
Source NVD
Published 2023-08-04
Updated 2026-08-20
Modified 2026-06-17
Fix URL N/A

Affected Packages

Software From version Fixed in
gs21-firmware — 01.50.000
gs25-firmware — 01.50.000
gt-designer3 — 1.300n
gt-softgot2000 — 1.300n
gt21-firmware — 01.50.000
gt23-firmware — 01.50.000
gt25-firmware — 01.50.000
gt27-firmware — 01.50.000

Similar Threats

Site Security Check

Is gs21-firmware part of your stack?

CVE-2023-0525 is rated CVSS 7.5 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓