Vulnerability · Published Nov 24, 2022 · Assigned by Mitsubishi

CVE-2022-29825

Medium 5.6

In plain English

A medium-severity security flaw in GT Designer3 Version1 (GOT2000) from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	from 1.000A to 1.090U
Mitsubishi Electric Corporation	GT Designer3 Version1 (GOT2000)	from 1.122C to 1.290C
Mitsubishi Electric Corporation	MT Works2	from 1.100E to 1.200J

Weakness: CWE-259 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU97244961/index.html government-resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05 government-resource