Log in Start free

Vulnerability · Published Jan 30, 2024 · Assigned by Mitsubishi

CVE-2023-6942

High 7.5

In plain English

A high-severity missing authentication in EZSocket from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 38.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation EZSocket 3.0 to 5.92
Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000) 1.325P and prior
Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000) 1.320J and prior
Mitsubishi Electric Corporation GX Works2 1.11M to 1.626C
Mitsubishi Electric Corporation GX Works3 1.106L and prior
Mitsubishi Electric Corporation MELSOFT Navigator 1.04E to 2.102G
Mitsubishi Electric Corporation MT Works2 1.190Y and prior
Mitsubishi Electric Corporation MX Component 4.00A to 5.007H
Mitsubishi Electric Corporation MX OPC Server DA/UA all versions

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References