Critical severity · published Jan 30, 2024
CVE-2023-6943
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3…
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EZ
EZSocket · Mitsubishi Electric Corporation
3.0 to 5.92 · source: vendor, NVD
GD
GT Designer3 Version1(GOT1000) · Mitsubishi Electric Corporation
1.325P and prior · source: vendor
GD
GT Designer3 Version1(GOT2000) · Mitsubishi Electric Corporation
1.320J and prior · source: vendor
GW
GX Works2 · Mitsubishi Electric Corporation
1.11M to 1.626C · source: vendor, NVD
GW
GX Works3 · Mitsubishi Electric Corporation
1.106L and prior · source: vendor, NVD
MN
MELSOFT Navigator · Mitsubishi Electric Corporation
1.04E to 2.102G · source: vendor, NVD
MW
MT Works2 · Mitsubishi Electric Corporation
1.190Y and prior · source: vendor, NVD
MC
MX Component · Mitsubishi Electric Corporation
4.00A to 5.007H · source: vendor, NVD
MO
MX OPC Server DA/UA · Mitsubishi Electric Corporation
all versions · source: vendor
FC
FR Configurator2 · Mitsubishielectric
All versions, or not specified · source: NVD
GO
Got1000 · Mitsubishielectric
All versions, or not specified · source: NVD
GO
Got2000 · Mitsubishielectric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6943
Third Party Advisory
https://jvn.jp/vu/JVNVU95103362
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf
More from EZSocket
7.5
CVE-2023-6942
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and…
