Vulnerability · Published Nov 24, 2022 · Assigned by Mitsubishi

CVE-2022-29830

Critical 9.1

In plain English

A critical-severity security flaw in GX Works3 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.4%top 28.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	from 1.000A to 1.095Z
Mitsubishi Electric Corporation	Motion Control Setting(GX Works3 related software)	from 1.000A to 1.065T

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU97244961/index.html government-resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05 government-resource