Log in Start free

Vulnerability · Published Jan 30, 2024 · Assigned by Mitsubishi

CVE-2023-6943

Critical 9.8

In plain English

A critical-severity security flaw in EZSocket from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation EZSocket 3.0 to 5.92
Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000) 1.325P and prior
Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000) 1.320J and prior
Mitsubishi Electric Corporation GX Works2 1.11M to 1.626C
Mitsubishi Electric Corporation GX Works3 1.106L and prior
Mitsubishi Electric Corporation MELSOFT Navigator 1.04E to 2.102G
Mitsubishi Electric Corporation MT Works2 1.190Y and prior
Mitsubishi Electric Corporation MX Component 4.00A to 5.007H
Mitsubishi Electric Corporation MX OPC Server DA/UA all versions

Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References