Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')…
Priority MEDIUM 53CWE-470Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02133 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | EZSocket | 3.0 to 5.92 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT1000) | up to 1.325P | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT2000) | up to 1.320J | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works2 | 1.11M to 1.626C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works3 | up to 1.106L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT Navigator | 1.04E to 2.102G | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MT Works2 | up to 1.190Y | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX Component | 4.00A to 5.007H | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX OPC Server DA/UA | all versions | — | No fix listed | CNA |
- EZSocket VendorMitsubishi Electric Corporation Affected 3.0 to 5.92 Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT1000) VendorMitsubishi Electric Corporation Affected up to 1.325P Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT2000) VendorMitsubishi Electric Corporation Affected up to 1.320J Fixed in — No fix listed CNA
- GX Works2 VendorMitsubishi Electric Corporation Affected 1.11M to 1.626C Fixed in — No fix listed CNA
- GX Works3 VendorMitsubishi Electric Corporation Affected up to 1.106L Fixed in — No fix listed CNA
- MELSOFT Navigator VendorMitsubishi Electric Corporation Affected 1.04E to 2.102G Fixed in — No fix listed CNA
- MT Works2 VendorMitsubishi Electric Corporation Affected up to 1.190Y Fixed in — No fix listed CNA
- MX Component VendorMitsubishi Electric Corporation Affected 4.00A to 5.007H Fixed in — No fix listed CNA
- MX OPC Server DA/UA VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* | 3.0 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:got1000:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:got2000:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* | 1.11m | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* | 1.04e | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* | 4.00a | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:got1000:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:got2000:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* Versions 1.11m Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* Versions 1.04e Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* Versions 4.00a Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Mitsubishi Electric EZSocket, GT Designer3 Version1(GOT1000) and 7 more products — mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_…
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-06345 Missing authentication in Mitsubishi Electric Corporation EZSocketPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6943
- 2026-10-03 Alias added: GHSA-8g5q-mp2w-j766
References
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
- TI-2025-03259 Missing authentication in Mitsubishi Electric Corporation G-50 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6943 · CVE Program
- CVE-2023-6943 · NVD
- FIRST EPSS
- GHSA-8g5q-mp2w-j766 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences