PT-2022-19864 · Iconics · Iconics Genesis64

Published 2022-03-30 · Updated 2026-01-09 · CVE-2022-29834

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS64 versions 10.97 to 10.97.1

Description The issue allows a remote unauthenticated attacker to access arbitrary files in the GENESIS64 server and disclose information stored in the files. This is achieved by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and then accessing the monitoring screen.

Recommendations For ICONICS GENESIS64 versions 10.97 to 10.97.1, consider restricting access to the monitoring screen and avoid using malicious URL parameters until a patch is available. As a temporary workaround, restrict the use of the URL parameter in the monitoring screen to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-06764

CVE-2022-29834

ZDI-22-1042

Affected Products

Iconics Genesis64

References · 11

• https://zerodayinitiative.com/advisories/ZDI-22-1042 · Security Note
• https://bdu.fstec.ru/vul/2025-06764 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29834 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf · Vendor Advisory
• https://t.me/cveNotify/148173 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-22-202-04 · Note
• https://jvn.jp/vu/JVNVU96480474/index.html · Note
• https://t.me/cvenotify/33863 · Telegram Post
• https://mitsubishielectric.com/psirt/vulnerability/pdf/2022-008_en.pdf · Note
• https://t.me/cibsecurity/46690 · Telegram Post