CVE-2023-6374 is a medium severity authentication bypass in the Mitsubishi Electric MELSEC WS Series module WS0-GETH00200. A remote attacker who captures a login exchange may replay it and log in to the module. The record lists all serial numbers as affected, so follow the vendor advisory.
What's affected
- Product: Mitsubishi Electric MELSEC WS Series, model WS0-GETH00200 (firmware and hardware).
- Affected: all serial numbers, per the record.
- Fixed version: the record gives none. Use the Mitsubishi Electric PSIRT document 2023-019 listed in the references for mitigations or any fix.
- Impact in the record: an attacker who logs in may be able to disclose or tamper with programs and parameters in the module.
The record gives a CVSS 3.1 base score of 5.9 (medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
This is an industrial controller module, so there is no package manager command. Check your asset register for the WS0-GETH00200 and note its network location.
nmap -p- --open -sT 192.0.2.10
The address above is a documentation example; replace it with the module address, and only scan equipment you own and are permitted to test, ideally in a maintenance window. The purpose is to confirm who can reach the module on the network, since the flaw needs network access.
What to do now
- Locate every WS0-GETH00200 and record its firmware and network segment.
- Read the Mitsubishi Electric advisory 2023-019 and the CISA ICS advisory ICSA-24-030-03 for mitigations.
- Limit network access to the module to the engineering workstations that need it, behind a firewall or VPN.
- Review module logs and project files for unexpected changes to programs or parameters.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-294 (Authentication Bypass by Capture-replay): Authentication traffic can be recorded and sent again later to gain access, because the exchange does not bind a login to a single use.
Capture-replay means the login exchange can be recorded and played back later, because nothing in it ties the login to a single use. An attacker on the network path who sees one valid exchange may reuse it.
The rating is medium because the attack complexity is high and the impact described is integrity of programs and parameters. In a plant that still matters, since a changed parameter can change physical behaviour. Network segmentation does most of the work here, and the vendor advisory is the place to confirm any further steps.
Quick check
Is there a fixed firmware version?
The record does not name one. Check the Mitsubishi Electric advisory 2023-019 for current guidance.
Why is the severity medium?
The vector shows high attack complexity and an integrity only impact, which gives a base score of 5.9.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
