CVE-2023-3373

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-342 CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-337309.8Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remot CVE-2023-337316.1Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 CVE-2023-337326.1Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacke CVE-2023-337337.8Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.CVE-2023-337349.8BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php.CVE-2023-337359.8D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter i CVE-2023-337365.4A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a CVE-2023-33749.8Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0 CVE-2023-337407.5Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify paramete CVE-2023-337417.5Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.CVE-2023-337427.5TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.CVE-2023-337439.8TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.