Critical severity · published Jan 21, 2022
CVE-2022-23128
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to…
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Analytix · Iconics
10.95.3 through 10.97 · source: NVD
GE
Genesis64 · Iconics
10.95.3 through 10.97 · source: NVD
HH
Hyper Historian · Iconics
10.95.3 through 10.97 · source: NVD
MW
MC Works64 · Mitsubishielectric
10.95.201.23 through 10.95.210.01 · source: NVD
MO
Mobilehmi · Iconics
10.95.3 through 10.97 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23128
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23128
Mitigation
https://jvn.jp/vu/JVNVU95403720/index.html
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01
Mitigation
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf