CVE-2023-6943 is a critical (CVSS 9.8) unsafe reflection flaw in Mitsubishi Electric FA engineering software, including EZSocket, GX Works2 and GX Works3. A remote unauthenticated attacker can run malicious code through RPC. Update to the fixed versions listed by CISA and the vendor.
What's affected
The record and the CISA advisory ICSA-24-030-02 (Update D) list EZSocket 3.0 to 5.92, GT Designer3 Version1 (GOT1000) 1.325P and prior, GT Designer3 Version1 (GOT2000) 1.320J and prior, GX Works2 1.11M to 1.626C, GX Works3 1.106L and prior, MELSOFT Navigator 1.04E to 2.102G, MT Works2 1.190Y and prior, MX Component 4.00A to 5.007H, and all versions of MX OPC Server DA/UA.
CISA lists these fixed or later versions: EZSocket 5.A, GT Designer3 (GOT1000) 1.330U, GT Designer3 (GOT2000) 1.325P, GX Works2 1.630G, GX Works3 1.110Q, MELSOFT Navigator 2.106L, MT Works2 1.195D and MX Component 5.008J. The advisory text read for this post gives no fixed version for MX OPC Server DA/UA, so rely on the vendor advisory for that product.
How to check if you're exposed
Open each engineering workstation and check the installed version of each Mitsubishi Electric product in the list. Windows lists installed programs with versions.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match 'GX Works|GT Designer|MELSOFT|EZSocket|MX Component|MT Works' | Select DisplayName, DisplayVersion
Also check the 32-bit uninstall key, and engineering laptops that visit plants only occasionally.
What to do now
- Update to the fixed versions in the CISA advisory, or the later versions listed by Mitsubishi Electric.
- Use a firewall or VPN when connecting engineering PCs to the internet, and allow only trusted users to log in remotely.
- Run these PCs inside a LAN and block access from untrusted networks and hosts.
- Restrict physical access to engineering PCs and to the network devices that can reach them.
Why it matters
The record tags CWE-470, use of externally controlled input to select classes or code. The description says a remote unauthenticated attacker can execute malicious code by RPC with a path to a malicious library while connected to the products. In plain terms, the software can be told to load code the attacker chooses.
It pairs with CVE-2023-6942, which covers missing authentication in the same products and has a high score. Engineering PCs hold project files and connect to controllers, so code running on them can reach the process network.
Firmware and engineering software update slowly. Start with an inventory of what you run and where it connects. Network isolation buys time while you test and schedule updates, and it is usually the first measure vendors recommend. Give each exception an owner and a review date so the workaround does not become permanent.
Weakness class in the record: CWE-470 (Unsafe Reflection).
Quick check
Is this the same as CVE-2023-6942?
No, but they were published together for the same products. One lets an attacker connect without authentication and the other lets an attacker make the software load code. Patch for both together.
What if we cannot patch quickly?
Reduce who and what can reach the device. Segment the network, restrict management access to a known host, and record the exception with an owner and a review date.
Sources
Last reviewed: 19 October 2026.
