Missing Authentication for Critical Function in Mitsubishi Electric products - CVE-2023-6942

Vulnerability identifier: #VU85933

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6942

CWE-ID: CWE-306

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for critical function. A remote attacker can send specially crafted packets and bypass authentication.

EZSocket
FR Configurator2
GT Designer3 Version1(GOT1000)
GT Designer3 Version1(GOT2000)
MX OPC Server DA
GX Works2
GX Works3
MELSOFT Navigator
MT Works2
MX Component
MX OPC Server UA

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf
• https://jvn.jp/vu/JVNVU95103362
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02

• Multiple vulnerabilities in Mitsubishi Electric FA Engineering Software Products