CVE-2023-6943: Critical severity Mitsubishielectric Ezsocket vulnerability
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6943?
CVE-2023-6943 has been classified with a critical severity due to its potential exploitation leading to unsafe reflection.
How do I fix CVE-2023-6943?
To resolve CVE-2023-6943, users should update their affected Mitsubishi Electric products to the latest versions as specified in the vendor's advisory.
What products are affected by CVE-2023-6943?
CVE-2023-6943 affects various Mitsubishi Electric products including EZSocket, GT Designer3, GX Works2, and MELSOFT Navigator among others.
Can CVE-2023-6943 lead to unauthorized code execution?
Yes, CVE-2023-6943 allows attackers to potentially execute arbitrary code due to unsafe reflection mechanisms.
Is there a workaround for CVE-2023-6943?
Currently, it is recommended to apply the latest patches as workarounds for CVE-2023-6943 may not be effective against the underlying issue.