CVE-2023-6943
First published: Tue Jan 30 2024(Updated: )
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M and later, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.
Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mitsubishi Electric EZSocket | ||
| : Mitsubishi Electric GT Designer3 Version1(GOT1000) | ||
| Mitsubishi Electric GT Designer3 Version1 (GOT2000) | ||
| : Mitsubishi Electric GX Works2: Versions 1.11M and later | ||
| : Mitsubishi Electric GX Works3: Versions 1.106L and prior | ||
| Mitsubishi Electric MELSOFT Navigator | ||
| Mitsubishi Electric MT Works2 | ||
| Mitsubishi Electric MX Component | ||
| : Mitsubishi Electric MX OPC Server DA/UA (Software packaged with MC Works64) | ||
| Mitsubishi Electric EZSocket | >=3.0 | |
| Mitsubishielectric Fr Configurator2 | ||
| Mitsubishielectric Got1000 | ||
| Mitsubishielectric Got2000 | ||
| Mitsubishielectric Gx Works2 | >=1.11m | |
| Mitsubishielectric Gx Works3 | ||
| Mitsubishi Electric MC Works64 | ||
| Mitsubishi Electric MELSOFT Navigator | >=1.04e | |
| Mitsubishi Electric MT Works2 | ||
| Mitsubishi Electric MX Component | >=4.00a |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-6943?
CVE-2023-6943 has been classified with a critical severity due to its potential exploitation leading to unsafe reflection.
How do I fix CVE-2023-6943?
To resolve CVE-2023-6943, users should update their affected Mitsubishi Electric products to the latest versions as specified in the vendor's advisory.
What products are affected by CVE-2023-6943?
CVE-2023-6943 affects various Mitsubishi Electric products including EZSocket, GT Designer3, GX Works2, and MELSOFT Navigator among others.
Can CVE-2023-6943 lead to unauthorized code execution?
Yes, CVE-2023-6943 allows attackers to potentially execute arbitrary code due to unsafe reflection mechanisms.
Is there a workaround for CVE-2023-6943?
Currently, it is recommended to apply the latest patches as workarounds for CVE-2023-6943 may not be effective against the underlying issue.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/severity
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- collector/nvd-api
- source/NVD
- vendor/: mitsubishi electric
- canonical/mitsubishi electric ezsocket
- canonical/: mitsubishi electric gt designer3 version1(got1000)
- canonical/mitsubishi electric gt designer3 version1 (got2000)
- canonical/: mitsubishi electric gx works2: versions 1.11m and later
- canonical/: mitsubishi electric gx works3: versions 1.106l and prior
- canonical/mitsubishi electric melsoft navigator
- canonical/mitsubishi electric mt works2
- canonical/mitsubishi electric mx component
- canonical/: mitsubishi electric mx opc server da/ua (software packaged with mc works64)
- vendor/mitsubishielectric
- version/mitsubishi electric ezsocket/3.0
- canonical/mitsubishielectric fr configurator2
- canonical/mitsubishielectric got1000
- canonical/mitsubishielectric got2000
- canonical/mitsubishielectric gx works2
- version/mitsubishielectric gx works2/1.11m
- canonical/mitsubishielectric gx works3
- canonical/mitsubishi electric mc works64
- version/mitsubishi electric melsoft navigator/1.04e
- version/mitsubishi electric mx component/4.00a