PT-2022-6320 · Mitsubishi · Gx Works3

Published 2022-11-24 · Updated 2023-06-29 · CVE-2022-29831

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z

Description The issue is related to the use of hard-coded passwords in the software, allowing a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules. This could potentially be exploited by an attacker to gain unauthorized access to sensitive information.

Recommendations For versions from 1.015R to 1.095Z, consider disabling the use of hard-coded passwords as a temporary workaround until a patch is available. Restrict access to the project file for MELSEC safety CPU modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

BDU:2023-00840

CVE-2022-29831

Affected Products

Gx Works3

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-29831 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29831 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00840 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf · Vendor Advisory
• https://t.me/cvenotify/53284 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-333-05 · Note
• https://jvn.jp/vu/JVNVU97244961 · Note
• https://jvn.jp/vu/JVNVU97244961/index.html · Note
• https://t.me/true_secator/3785 · Telegram Post
• https://t.me/cvenotify/51452 · Telegram Post