High severity · published Nov 24, 2022
CVE-2022-29826
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software)…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GW
GX Works3 · Mitsubishi Electric Corporation
from 1.000A to 1.087R · source: vendor, NVD
MC
Motion Control Setting(GX Works3 related software) · Mitsubishi Electric Corporation
from 1.000A to 1.042U · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29826
Third Party Advisory
https://jvn.jp/vu/JVNVU97244961/index.html
www.cisa.gov
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
Mitigation
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
More from GX Works3
9.8
CVE-2023-6943
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3…
9.2
CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
9.1
CVE-2022-29830
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions…
7.8
CVE-2023-5247
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to…
7.8
CVE-2023-4088
Malicious Code Execution Vulnerability in FA Engineering Software Products