PT-2022-6456 · Mitsubishi · Mitsubishi Electric Gx Works3+1

Anton Dorfman + 3 · Published 2022-11-24 · Updated 2025-11-07 · CVE-2022-29825

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C

Description The issue is related to the use of hard-coded passwords in the software, allowing an unauthenticated attacker to disclose sensitive information. This can result in unauthenticated users being able to view programs and project files or execute programs illegally. The vulnerability can be exploited by a remote attacker to gain access to protected information.

Recommendations For Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, consider changing or removing the hard-coded password to prevent unauthorized access. For GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, restrict access to sensitive information and project files until a patch or update is available that addresses the hard-coded password issue. As a temporary workaround, consider disabling any features that rely on the hard-coded password until a secure update is applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

BDU:2023-01472

CVE-2022-29825

Affected Products

Gt Designer3 Version1

Mitsubishi Electric Gx Works3

References · 8

• https://bdu.fstec.ru/vul/2023-01472 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29825 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-333-05 · Note
• https://t.me/cvenotify/51461 · Telegram Post
• https://jvn.jp/vu/JVNVU97244961/index.html · Note
• https://t.me/cveNotify/142065 · Telegram Post