PT-2022-19862 · Mitsubishi · Gx Developer+2

Ivan Speziale · Published 2022-11-24 · Updated 2023-05-31 · CVE-2022-29832

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation GX Works3 versions 1.015R and later Mitsubishi Electric Corporation GX Works2 all versions Mitsubishi Electric Corporation GX Developer versions 8.40S and later

Description The issue allows a remote unauthenticated attacker to disclose sensitive information. Unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.

Recommendations For GX Works3 versions 1.015R and later, update to a version that addresses the Cleartext Storage of Sensitive Information in Memory issue. For GX Works2 all versions, consider restricting access to sensitive project files until a fix is available. For GX Developer versions 8.40S and later, avoid storing sensitive information in memory until the issue is resolved. As a temporary workaround, consider disabling remote access to project files for MELSEC safety CPU modules or MELSEC Q/FX/L series with security setting until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-316

CWE-312

Related Identifiers

CVE-2022-29832

Affected Products

Gx Developer

Gx Works2

Gx Works3

References · 7

• https://osv.dev/vulnerability/CVE-2022-29832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29832 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-333-05 · Note
• https://jvn.jp/vu/JVNVU97244961 · Note
• https://t.me/true_secator/3785 · Telegram Post
• https://t.me/cvenotify/51454 · Telegram Post