PT-2024-1480 · Mitsubishi · Fr Configurator2+8

Reid Wightman · Published 2024-01-30 · Updated 2025-02-13 · CVE-2023-6942

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric EZSocket versions 3.0 to 5.92 Mitsubishi Electric GT Designer3 Version1(GOT1000) versions 1.325P and prior Mitsubishi Electric GT Designer3 Version1(GOT2000) versions 1.320J and prior Mitsubishi Electric GX Works2 versions 1.11M and later Mitsubishi Electric GX Works3 versions 1.106L and prior Mitsubishi Electric MELSOFT Navigator versions 1.04E to 2.102G Mitsubishi Electric MT Works2 versions 1.190Y and prior Mitsubishi Electric MX Component versions 4.00A to 5.007H Mitsubishi Electric MX OPC Server DA/UA all versions Mitsubishi Electric FR Configurator2 all versions

Description The issue is related to a lack of authentication for a critical function, allowing a remote attacker to gain unauthorized access to confidential information by sending specially crafted packets. This can enable the attacker to bypass authentication and connect to the products illegally.

Recommendations For Mitsubishi Electric EZSocket versions 3.0 to 5.92, update to a version that includes a fix for this issue. For Mitsubishi Electric GT Designer3 Version1(GOT1000) versions 1.325P and prior, update to a version that includes a fix for this issue. For Mitsubishi Electric GT Designer3 Version1(GOT2000) versions 1.320J and prior, update to a version that includes a fix for this issue. For Mitsubishi Electric GX Works2 versions 1.11M and later, update to a version that includes a fix for this issue. For Mitsubishi Electric GX Works3 versions 1.106L and prior, update to a version that includes a fix for this issue. For Mitsubishi Electric MELSOFT Navigator versions 1.04E to 2.102G, update to a version that includes a fix for this issue. For Mitsubishi Electric MT Works2 versions 1.190Y and prior, update to a version that includes a fix for this issue. For Mitsubishi Electric MX Component versions 4.00A to 5.007H, update to a version that includes a fix for this issue. For Mitsubishi Electric MX OPC Server DA/UA all versions, update to a version that includes a fix for this issue. For Mitsubishi Electric FR Configurator2 all versions, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-00987

CVE-2023-6942

Affected Products

Ezsocket

Fr Configurator2

Gt Designer3 Version1

Gx Works2

Gx Works3

Melsoft Navigator

Mt Works2

Mx

Mx Opc Server Da/Ua

References · 20

• https://bdu.fstec.ru/vul/2024-00987 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6942 · Security Note
• https://t.me/cvenotify/107603 · Telegram Post
• https://jvn.jp/vu/JVNVU95103362 · Note
• https://t.me/cvenotify/111182 · Telegram Post
• https://twitter.com/transilienceai/status/1856751235904541162 · Twitter Post
• https://twitter.com/transilienceai/status/1857115988036296819 · Twitter Post
• https://twitter.com/transilienceai/status/1856929639437848664 · Twitter Post
• https://t.me/cvenotify/70615 · Telegram Post
• https://twitter.com/RedPacketSec/status/1752634073376272689 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-030-02 · Note
• https://t.me/cvenotify/69195 · Telegram Post
• https://twitter.com/NUYTSTECH/status/1761568247210799309 · Twitter Post