Vulnerability · Published Nov 24, 2022 · Assigned by Mitsubishi
CVE-2022-29828
Medium 6.8
In plain English
A medium-severity security flaw in GX Works3 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.2%top 32.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project file or execute programs illegally.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishi Electric Corporation | GX Works3 | from 1.000A and later |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf vendor-advisory
- https://jvn.jp/vu/JVNVU97244961/index.html government-resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05 government-resource