VulnerabilityModified

CVE-2023-6942

HIGH 7.5EPSS 0.95%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.95% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: mitsubishielectric/ezsocket · mitsubishielectric/fr configurator2 · mitsubishielectric/got1000 · mitsubishielectric/got2000 · mitsubishielectric/gx works2 · mitsubishielectric/gx works3 · mitsubishielectric/mc works64 · mitsubishielectric/melsoft navigator · mitsubishielectric/mt works2 · mitsubishielectric/mx component
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

References

https://jvn.jp/vu/JVNVU95103362Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdfVendor Advisory
https://jvn.jp/vu/JVNVU95103362Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.