PT-2022-15871 · Iconics+1 · Iconics Mobilehmi+1

Published 2022-01-21 · Updated 2022-01-27 · CVE-2022-23127

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior ICONICS MobileHMI versions 10.96.2 and prior

Description A Cross-site Scripting issue allows a remote unauthenticated attacker to gain authentication information and perform any operation using the acquired authentication information. This is achieved by injecting a malicious script in the URL of a monitoring screen delivered from the server to an application for mobile devices, leading a legitimate user to access this URL.

Recommendations For Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior, consider disabling access to monitoring screens until a patch is available. For ICONICS MobileHMI versions 10.96.2 and prior, restrict the use of the affected URL parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23127

Affected Products

Iconics Mobilehmi

Mitsubishi Electric Mc Works64

References · 6

• https://osv.dev/vulnerability/CVE-2022-23127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23127 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf · Vendor Advisory
• https://t.me/cibsecurity/36065 · Telegram Post
• https://jvn.jp/vu/JVNVU95403720/index.html · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-020-01 · Note