Vulnerability · Published Nov 24, 2022 · Assigned by Mitsubishi

CVE-2022-29832

Low 3.7

In plain English

A low-severity security flaw in GX Developer from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	1.015R and later
Mitsubishi Electric Corporation	GX Works2	all versions
Mitsubishi Electric Corporation	GX Developer	8.40S and later

Weakness: CWE-316 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU97244961 government-resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05 government-resource