CVE-2023-6943

State: Published
Severity: 9.8 Critical
Published: Jan 30, 2024
Updated: Sep 19, 2025
Reserved: Dec 19, 2023

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Mitsubishi

Weaknesses

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Affected Products

Product	Versions
EZSocketMitsubishi Electric Corporation	3.0 to 5.92Affected
GT Designer3 Version1(GOT1000)Mitsubishi Electric Corporation	1.325P and priorAffected
GT Designer3 Version1(GOT2000)Mitsubishi Electric Corporation	1.320J and priorAffected
GX Works2Mitsubishi Electric Corporation	1.11M to 1.626CAffected
GX Works3Mitsubishi Electric Corporation	1.106L and priorAffected
MELSOFT NavigatorMitsubishi Electric Corporation	1.04E to 2.102GAffected
MT Works2Mitsubishi Electric Corporation	1.190Y and priorAffected
MX ComponentMitsubishi Electric Corporation	4.00A to 5.007HAffected
MX OPC Server DA/UAMitsubishi Electric Corporation	all versionsAffected

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdfvendor-advisory
https://jvn.jp/vu/JVNVU95103362government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.