ICSA-24-030-02: Mitsubishi Electric FA Engineering Software Products (Update D)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose, tamper with, destroy or delete information in the products, or cause a denial-of-service (DoS) condition on the products. CVE-2023-6942: A remote unauthenticated attacker may be able to bypass authentication by sending specially crafted packets and connect to the products illegally. CVE-2023-6943: An attacker may be able to execute a malicious code by remotely calling a function with a path to a malicious library while connected to the products. As a result, unauthorized users may disclose, tamper with, destroy or delete information in the products, or cause a denial-of-service (DoS) condition on the products.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-24-030-02
Status: Final · version 5
Initial release: 2024-01-30
Last revised: 2025-09-18 (5 revisions)
Vendor: Mitsubishi Electric
Critical infrastructure sectors: Critical Manufacturing
Deployed: Worldwide
Vendor headquarters: Japan

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Reid Wightman (Dragos)

Affected products (9)

EZSocket — >=3.0|<5.92
GT Designer3 Version1(GOT1000) — <=1.325P
GT Designer3 Version1(GOT2000) — <=1.320J
GX Works2 — >=1.11M|<1.626C
GX Works3 — <=1.106L
MELSOFT Navigator — >=1.04E|<2.102G
MT Works2 — <=1.190Y
MX Component — >=4.00A|<5.007H
MX OPC Server DA/UA (Software packaged with MC Works64) — all versions

Revision history (5)

2025-09-18 — v5: Update D - Update to affected versions and mitigations.
2025-02-13 — v4: Update C - Update to affected versions and mitigations.
2025-01-16 — v3: Update B - Update to affected versions and mitigations.
2024-10-31 — v2: Update A - Update to affected products and mitigation section.
2024-01-30 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2023-6943	CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	9.8 Critical	An attacker may be able to execute a malicious code by remotely calling a function with a path to a malicious library while connected to the products. As a result, unauthorized users may disclose, tamper with, destroy or delete information in the products, or cause a denial-of-service (DoS) condition on the products. Mitigation: Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Vendor fix: EZSocket: Download version 5.A or later. ↗ Mitigation: GT Designer3 Version1(GOT1000): Download version 1.330U or later. ↗ Affected, fixed & timeline Affected: EZSocket >=3.0\|<5.92 GT Designer3 Version1(GOT1000) <=1.325P GT Designer3 Version1(GOT2000) <=1.320J GX Works2 >=1.11M\|<1.626C GX Works3 <=1.106L MELSOFT Navigator >=1.04E\|<2.102G MT Works2 <=1.190Y MX Component >=4.00A\|<5.007H MX OPC Server DA/UA (Software packaged with MC Works64) all versions Mitigation: GT Designer3 Version1(GOT2000): Download version 1.325P or later. Vendor fix: GX Works2: Download version 1.630G or later. Vendor fix: GX Works3: Download version 1.110Q or later. Vendor fix: MELSOFT Navigator: Download version 2.106L or later. Vendor fix: MT Works2: Download version 1.195D or later. Vendor fix: MX Component: Download version 5.008J or later. Mitigation: When connecting your personal computer with the affected products to the internet, use a firewall, virtual private network (VPN), etc., to prevent unauthorized access and allow only trusted users to remote login. Mitigation: Use your personal computer with the affected products within a LAN and block access from untrusted networks and hosts. Mitigation: Restrict physical access to your computer using the affected products as well as to the personal computers and network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer using the affected products and on the personal computers that can communicate with it. Mitigation: Don't open untrusted files or click untrusted links. Mitigation: For more information, see Mitsubishi Electric's security advisory.
CVE-2023-6942	CWE-306 Missing Authentication for Critical Function	7.5 High	A remote unauthenticated attacker may be able to bypass authentication by sending specially crafted packets and connect to the products illegally. Mitigation: Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Vendor fix: EZSocket: Download version 5.A or later. ↗ Mitigation: GT Designer3 Version1(GOT1000): Download version 1.330U or later. ↗ Affected, fixed & timeline Affected: EZSocket >=3.0\|<5.92 GT Designer3 Version1(GOT1000) <=1.325P GT Designer3 Version1(GOT2000) <=1.320J GX Works2 >=1.11M\|<1.626C GX Works3 <=1.106L MELSOFT Navigator >=1.04E\|<2.102G MT Works2 <=1.190Y MX Component >=4.00A\|<5.007H MX OPC Server DA/UA (Software packaged with MC Works64) all versions Mitigation: GT Designer3 Version1(GOT2000): Download version 1.325P or later. Vendor fix: GX Works2: Download version 1.630G or later. Vendor fix: GX Works3: Download version 1.110Q or later. Vendor fix: MELSOFT Navigator: Download version 2.106L or later. Vendor fix: MT Works2: Download version 1.195D or later. Vendor fix: MX Component: Download version 5.008J or later. Mitigation: When connecting your personal computer with the affected products to the internet, use a firewall, virtual private network (VPN), etc., to prevent unauthorized access and allow only trusted users to remote login. Mitigation: Use your personal computer with the affected products within a LAN and block access from untrusted networks and hosts. Mitigation: Restrict physical access to your computer using the affected products as well as to the personal computers and network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer using the affected products and on the personal computers that can communicate with it. Mitigation: Don't open untrusted files or click untrusted links. Mitigation: For more information, see Mitsubishi Electric's security advisory.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2023-6943	9.8 Critical	Mitsubishi Electric Corporation EZSocket Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions…
CVE-2023-6942	7.5 High	Mitsubishi Electric Corporation EZSocket Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GO…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC