CVE-2023-6943: Mitsubishi EZSocket RCE Vulnerability

CVE-2023-6943 Overview

CVE-2023-6943 is a critical Unsafe Reflection vulnerability (CWE-470) affecting multiple Mitsubishi Electric Corporation industrial automation software products. This vulnerability allows a remote unauthenticated attacker to execute malicious code by exploiting RPC (Remote Procedure Call) functionality with a path to a malicious library while connected to the affected products.

The vulnerability stems from the use of externally-controlled input to select classes or code, a dangerous pattern that enables attackers to dynamically load and execute arbitrary code without requiring authentication. Given that these products are widely deployed in industrial control system (ICS) environments, successful exploitation could have severe consequences for operational technology (OT) infrastructure.

Critical Impact

Remote unauthenticated code execution in industrial automation software used in manufacturing and critical infrastructure environments, potentially enabling complete system compromise and disruption of industrial operations.

Affected Products

• Mitsubishi Electric EZSocket versions 3.0 to 5.92
• Mitsubishi Electric GT Designer3 Version1 (GOT1000) versions 1.325P and prior
• Mitsubishi Electric GT Designer3 Version1 (GOT2000) versions 1.320J and prior
• Mitsubishi Electric GX Works2 versions 1.11M to 1.626C
• Mitsubishi Electric GX Works3 versions 1.106L and prior
• Mitsubishi Electric MELSOFT Navigator versions 1.04E to 2.102G
• Mitsubishi Electric MT Works2 versions 1.190Y and prior
• Mitsubishi Electric MX Component versions 4.00A to 5.007H
• Mitsubishi Electric MX OPC Server DA/UA (all versions)
• Mitsubishi Electric FR Configurator2 (affected versions)
• Mitsubishi Electric MC Works64 (affected versions)

Discovery Timeline

• 2024-01-30 - CVE-2023-6943 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2023-6943

Vulnerability Analysis

This vulnerability represents a classic Unsafe Reflection flaw where the affected Mitsubishi Electric software products fail to properly validate or restrict externally-provided input used to dynamically load classes or code libraries. When an attacker establishes a connection to the vulnerable software, they can craft malicious RPC requests that specify a path to an attacker-controlled library file.

The vulnerability is particularly dangerous because it requires no authentication, operates over the network, and can be exploited without any user interaction. This combination makes it highly attractive to threat actors targeting industrial environments, where these engineering workstation applications are commonly deployed to configure and manage programmable logic controllers (PLCs), human-machine interfaces (HMIs), and other industrial automation equipment.

Root Cause

The root cause of CVE-2023-6943 lies in the improper handling of externally-controlled input within the RPC mechanism of affected Mitsubishi Electric products. The software accepts user-supplied paths or identifiers that are then used to dynamically load and instantiate code libraries without adequate validation. This unsafe reflection pattern violates the principle of least privilege by allowing external parties to influence code execution paths.

The vulnerable products fail to implement proper allowlisting of acceptable library paths, input sanitization, or authentication requirements before processing RPC requests that could lead to code loading. This design flaw allows attackers to redirect the reflection mechanism to load malicious libraries from attacker-controlled locations.

Attack Vector

The attack vector for this vulnerability involves network-based exploitation of the RPC interface exposed by affected Mitsubishi Electric products. An attacker can exploit this vulnerability by:

1. Identifying systems running vulnerable Mitsubishi Electric software on the network
2. Establishing a connection to the RPC service without authentication
3. Crafting a malicious RPC request that includes a path to an attacker-controlled library
4. The vulnerable software dynamically loads and executes the malicious library
5. The attacker achieves arbitrary code execution with the privileges of the affected application

The vulnerability mechanism involves the RPC handler accepting an externally-provided path parameter that is used to dynamically load a code library. Without proper validation, an attacker can specify a path to a malicious DLL or shared object file, which is then loaded and executed by the target application. For detailed technical information, refer to the CISA ICS Advisory and the Mitsubishi Electric Security Bulletin.

Detection Methods for CVE-2023-6943

Indicators of Compromise

• Unexpected network connections to Mitsubishi Electric engineering software from external or unauthorized IP addresses
• Unusual DLL or library loading events in process monitoring logs for affected applications
• Suspicious RPC traffic patterns or malformed RPC requests targeting affected products
• Presence of unauthorized library files in system directories or temporary folders

Detection Strategies

• Monitor network traffic for RPC communications to/from systems running Mitsubishi Electric engineering software
• Implement application allowlisting to detect unauthorized library loading attempts
• Deploy endpoint detection and response (EDR) solutions to identify suspicious code execution patterns in engineering workstation environments
• Use network intrusion detection systems (IDS) with signatures for known exploitation patterns targeting ICS software

Monitoring Recommendations

• Enable detailed logging for all Mitsubishi Electric engineering applications and review logs for anomalous activity
• Implement network segmentation monitoring between IT and OT zones to detect unauthorized cross-boundary traffic
• Monitor Windows Event Logs for process creation events and DLL loading associated with affected applications
• Establish baselines for normal RPC communication patterns and alert on deviations

How to Mitigate CVE-2023-6943

Immediate Actions Required

• Apply vendor-provided patches immediately for all affected Mitsubishi Electric products
• Isolate systems running affected software from untrusted networks using firewalls and network segmentation
• Restrict network access to engineering workstations to authorized personnel and systems only
• Implement application allowlisting on systems running affected Mitsubishi Electric software

Patch Information

Mitsubishi Electric has released security updates to address this vulnerability. Organizations should consult the Mitsubishi Electric Security Bulletin 2023-020 for detailed patch information and update procedures for each affected product. Given the critical nature of this vulnerability, applying patches should be prioritized.

Additional guidance is available from CISA ICS Advisory ICSA-24-030-02 and the JVN Vulnerability Report.

Workarounds

• Implement strict network segmentation to isolate engineering workstations from untrusted networks
• Use VPN or other secure remote access solutions if remote connectivity to engineering systems is required
• Deploy host-based firewalls to restrict inbound connections to affected applications
• Consider disabling unused RPC functionality where operationally feasible

# Example Windows Firewall rule to restrict access to engineering workstation
# Adjust port numbers based on specific Mitsubishi Electric product configuration
netsh advfirewall firewall add rule name="Block Unauthorized ICS Access" dir=in action=block protocol=tcp localport=5000-5100 remoteip=any
netsh advfirewall firewall add rule name="Allow Trusted ICS Access" dir=in action=allow protocol=tcp localport=5000-5100 remoteip=10.0.100.0/24