Vulnerability · Published Jan 21, 2022 · Assigned by Mitsubishi

CVE-2022-23129

Medium 5.5

In plain English

A medium-severity security flaw in Mitsubishi Electric MC Works64; ICONICS GENESIS64. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when configuration information of GridWorX, a database linkage function of GENESIS64 and MC Works64, is exported to a CSV file, the authentication information is saved in plaintext, and an attacker who can access this CSV file can gain the authentication information.

Affected products (as reported)

Vendor	Product	Versions
n/a	Mitsubishi Electric MC Works64; ICONICS GENESIS64	Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and priorICONICS GENESIS64 versions 10.90 to 10.97

References

https://jvn.jp/vu/JVNVU95403720/index.html x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01 x_refsource_MISC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-027_en.pdf x_refsource_MISC