Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Ve

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• mitsubishielectric ezsocket3.0 and later
• mitsubishielectric fr configurator2all versions
• mitsubishielectric got1000all versions
• mitsubishielectric got2000all versions
• mitsubishielectric gx works21.11m and later
• mitsubishielectric gx works3all versions
• mitsubishielectric mc works64all versions
• mitsubishielectric melsoft navigator1.04e and later
• mitsubishielectric mt works2all versions
• mitsubishielectric mx component4.00a and later

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Mitsubishi). Independent of NVD's CPE analysis and usually ahead of it.

• Mitsubishi Electric Corporation EZSocket

  • 3.0 to 5.92affected

• Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000)

  • 1.325P and prioraffected

• Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000)

  • 1.320J and prioraffected

• Mitsubishi Electric Corporation GX Works2

  • 1.11M to 1.626Caffected

• Mitsubishi Electric Corporation GX Works3

  • 1.106L and prioraffected

• Mitsubishi Electric Corporation MELSOFT Navigator

  • 1.04E to 2.102Gaffected

• Mitsubishi Electric Corporation MT Works2

  • 1.190Y and prioraffected

• Mitsubishi Electric Corporation MX Component

  • 4.00A to 5.007Haffected

• Mitsubishi Electric Corporation MX OPC Server DA/UA

  • all versionsaffected

Other highest-scoring records for the same primary product.

• CVE-2023-6943Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket
  40Plan
• CVE-2021-20607Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2
  22Monitor
• CVE-2021-20606Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.