CVE-2023-6942 is a high severity (CVSS 7.5) missing authentication flaw in Mitsubishi Electric FA engineering software including EZSocket, GX Works2, GX Works3 and MELSOFT Navigator. A remote unauthenticated attacker can connect by sending crafted packets. Update to the fixed versions in the advisory.
What's affected
The record and the CISA advisory ICSA-24-030-02 (Update D) list EZSocket 3.0 to 5.92, GT Designer3 Version1 (GOT1000) 1.325P and prior, GT Designer3 Version1 (GOT2000) 1.320J and prior, GX Works2 1.11M to 1.626C, GX Works3 1.106L and prior, MELSOFT Navigator 1.04E to 2.102G, MT Works2 1.190Y and prior, MX Component 4.00A to 5.007H, and all versions of MX OPC Server DA/UA.
CISA lists these fixed or later versions: EZSocket 5.A, GT Designer3 (GOT1000) 1.330U, GT Designer3 (GOT2000) 1.325P, GX Works2 1.630G, GX Works3 1.110Q, MELSOFT Navigator 2.106L, MT Works2 1.195D and MX Component 5.008J. The advisory text read for this post gives no fixed version for MX OPC Server DA/UA, so rely on the vendor advisory for that product.
How to check if you're exposed
Open each engineering workstation and check the installed version of each Mitsubishi Electric product in the list. Windows lists installed programs with versions.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match 'GX Works|GT Designer|MELSOFT|EZSocket|MX Component|MT Works' | Select DisplayName, DisplayVersion
Also check the 32-bit uninstall key, and engineering laptops that visit plants only occasionally.
What to do now
- Update to the fixed versions in the CISA advisory, or the later versions listed by Mitsubishi Electric.
- Use a firewall or VPN when connecting engineering PCs to the internet, and allow only trusted users to log in remotely.
- Run these PCs inside a LAN and block access from untrusted networks and hosts.
- Restrict physical access to engineering PCs and to the network devices that can reach them.
Why it matters
The record tags CWE-306, missing authentication for a critical function. The description says a remote unauthenticated attacker can bypass authentication by sending specially crafted packets and connect to the products illegally. Engineering software that talks to controllers can change PLC logic, so unauthorized connections matter for physical processes.
This CVE is one of a pair published together. The other, CVE-2023-6943, covers unsafe reflection in the same product family and carries a critical score. Fixing both usually means the same product updates.
Firmware and engineering software update slowly. Start with an inventory of what you run and where it connects. Network isolation buys time while you test and schedule updates, and it is usually the first measure vendors recommend. Give each exception an owner and a review date so the workaround does not become permanent.
Weakness class in the record: CWE-306 (Missing Authentication for Critical Function).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should engineering workstations be on the internet at all?
The vendor's own mitigation says to use them inside a LAN and, if internet access is needed, to put a firewall or VPN in front. Keep them off direct internet exposure.
What if we cannot patch quickly?
Reduce who and what can reach the device. Segment the network, restrict management access to a known host, and record the exception with an owner and a review date.
Sources
Last reviewed: 19 October 2026.
