PT-2022-4548 · Mitsubishi+1 · Mitsubishi Electric Mc Works64+1

Published 2022-01-20 · Updated 2022-01-27 · CVE-2022-23129

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior ICONICS GENESIS64 versions 10.90 to 10.97

Description The issue allows a local authenticated attacker to gain authentication information and access the database illegally due to the plaintext storage of a password. This occurs when configuration information of GridWorX, a database linkage function, is exported to a CSV file, saving authentication information in plaintext. An attacker with access to this CSV file can obtain the authentication information.

Recommendations For Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior, update to a version later than 4.04E (10.95.210.01) to resolve the issue. For ICONICS GENESIS64 versions 10.90 to 10.97, update to a version later than 10.97 to resolve the issue. As a temporary workaround, consider restricting access to the GridWorX database linkage function to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-256

Related Identifiers

BDU:2022-05424

CVE-2022-23129

Affected Products

Iconics Genesis64

Mitsubishi Electric Mc Works64

References · 7

• https://osv.dev/vulnerability/CVE-2022-23129 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05424 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-027_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23129 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01 · Note
• https://cybersecurity-help.cz/vdb/SB2022012107 · Note
• https://jvn.jp/vu/JVNVU95403720/index.html · Note