PT-2022-19860 · Mitsubishi · Gx Works3+2

Anton Dorfman + 3 · Published 2022-11-24 · Updated 2025-11-07 · CVE-2022-29829

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric GX Works3 versions 1.000A through 1.090U GT Designer3 Version1 (GOT2000) versions 1.122C through 1.290C Motion Control Setting (GX Works3 related software) versions 1.035M through 1.042U

Description The issue allows a remote unauthenticated attacker to disclose sensitive information due to the use of a hard-coded cryptographic key. This enables unauthenticated users to view programs and project files or execute programs illegally.

Recommendations For GX Works3 versions 1.000A through 1.090U, update to a version that does not use a hard-coded cryptographic key. For GT Designer3 Version1 (GOT2000) versions 1.122C through 1.290C, update to a version that does not use a hard-coded cryptographic key. For Motion Control Setting (GX Works3 related software) versions 1.035M through 1.042U, update to a version that does not use a hard-coded cryptographic key. As a temporary workaround, consider restricting access to sensitive information and project files to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2022-29829

Affected Products

Gt Designer3 Version1

Gx Works3

Motion Control Setting

References · 7

• https://osv.dev/vulnerability/CVE-2022-29829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29829 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf · Vendor Advisory
• https://t.me/cvenotify/51455 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-333-05 · Note
• https://jvn.jp/vu/JVNVU97244961/index.html · Note
• https://t.me/cveNotify/142066 · Telegram Post