CVE-2023-6943: got1000 — Fix

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.

Is your site exposed to CVE-2023-6943?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-470 CWE-470

Affected Products

Vendor	Product	Versions
mitsubishielectric	ezsocket	>= 3.0
mitsubishielectric	fr_configurator2	All
mitsubishielectric	got1000	All
mitsubishielectric	got2000	All
mitsubishielectric	gx_works2	>= 1.11m
mitsubishielectric	gx_works3	All
mitsubishielectric	mc_works64	All
mitsubishielectric	melsoft_navigator	>= 1.04e
mitsubishielectric	mt_works2	All
mitsubishielectric	mx_component	>= 4.00a

References

Advisories & Patches

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf

Other References

https://jvn.jp/vu/JVNVU95103362 https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02 https://jvn.jp/vu/JVNVU95103362 https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02

Frequently Asked Questions

What is CVE-2023-6943? +

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior, GX Works2 versions 1.11M to 1.626C, GX Works3 versions 1.106L and prior, MELSOFT Navigator versions 1.04E to 2.102G, MT Works2 versions 1.190Y and prior, MX Component versions 4.00A to 5.007H and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2023-6943? +

CVE-2023-6943 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2023-6943? +

CVE-2023-6943 affects products from mitsubishielectric, specifically: ezsocket, fr_configurator2, got1000, got2000, gx_works2, gx_works3, mc_works64, melsoft_navigator, mt_works2, mx_component. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-6943? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-61599

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport …

CVE-2026-108097

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This …

CVE-2026-55543

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an …

CVE-2026-108099

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This …

CVE-2026-73098

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type …

CVE-2026-44174

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that …