Paper/Archive/CVE-2022-29830

CVE-2022-29830

Mitsubishi Electric Corporation GX Works3 — Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Set…

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD, CNA agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 71.8.718 × 2014.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.

Affected

ProductAffectedFixed inSource

GX Works3from 1.000A to 1.095Z–CNA

Motion Control Setting(GX Works3 related software)from 1.000A to 1.065T–CNA

Scores by source

Mitsubishi (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorymitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf refjvn.jp/vu/JVNVU97244961/index.html refcisa.gov/uscert/ics/advisories/icsa-22-333-05