Missing authentication in Mitsubishi Electric Corporation EZSocket
Priority MEDIUM 41CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00949 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | EZSocket | 3.0 to 5.92 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT1000) | up to 1.325P | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT2000) | up to 1.320J | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works2 | 1.11M to 1.626C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works3 | up to 1.106L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT Navigator | 1.04E to 2.102G | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MT Works2 | up to 1.190Y | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX Component | 4.00A to 5.007H | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX OPC Server DA/UA | all versions | — | No fix listed | CNA |
- EZSocket VendorMitsubishi Electric Corporation Affected 3.0 to 5.92 Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT1000) VendorMitsubishi Electric Corporation Affected up to 1.325P Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT2000) VendorMitsubishi Electric Corporation Affected up to 1.320J Fixed in — No fix listed CNA
- GX Works2 VendorMitsubishi Electric Corporation Affected 1.11M to 1.626C Fixed in — No fix listed CNA
- GX Works3 VendorMitsubishi Electric Corporation Affected up to 1.106L Fixed in — No fix listed CNA
- MELSOFT Navigator VendorMitsubishi Electric Corporation Affected 1.04E to 2.102G Fixed in — No fix listed CNA
- MT Works2 VendorMitsubishi Electric Corporation Affected up to 1.190Y Fixed in — No fix listed CNA
- MX Component VendorMitsubishi Electric Corporation Affected 4.00A to 5.007H Fixed in — No fix listed CNA
- MX OPC Server DA/UA VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* | 3.0 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:got1000:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:got2000:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* | 1.11m | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* | 1.04e | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* | 4.00a | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:got1000:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:got2000:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* Versions 1.11m Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* Versions 1.04e Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* Versions 4.00a Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Mitsubishi Electric EZSocket, GT Designer3 Version1(GOT1000) and 7 more products — mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_…
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')…Priority MEDIUM 53
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6942
- 2026-10-03 Alias added: GHSA-w7vr-jmcf-cx4m
References
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6942 · CVE Program
- CVE-2023-6942 · NVD
- FIRST EPSS
- GHSA-w7vr-jmcf-cx4m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences