Lucene search

[email protected]CVE-2022-25160

HistoryApr 01, 2022 - 11:15 p.m.

CVE-2022-25160

2022-04-0123:15:14

CWE-312

[email protected]

web.nvd.nist.gov

cve-2022-25160

mitsubishi electric

melsec

iq-f

iq-r

cleartext storage

sensitive information

remote attack

unauthenticated

disclosure

counterfeiting

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.3%

JSON

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U© CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions and Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions allows a remote unauthenticated attacker to disclose a file in a legitimate user’s product by using previously eavesdropped cleartext information and to counterfeit a legitimate user’s system.

Affected configurations

NVD

Node

mitsubishielectricfx5uc_firmwareMatch-

AND

mitsubishielectricfx5ucMatch-

Node

mitsubishielectricfx5uc-32mr\/ds-ts_firmwareMatch-

AND

mitsubishielectricfx5uc-32mr\/ds-tsMatch-

Node

mitsubishielectricfx5uc-32mt\/d_firmwareMatch-

AND

mitsubishielectricfx5uc-32mt\/dMatch-

Node

mitsubishielectricfx5uc-32mt\/dss_firmwareMatch-

AND

mitsubishielectricfx5uc-32mt\/dssMatch-

Node

mitsubishielectricfx5uj-24mr\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-24mr\/esMatch-

Node

mitsubishielectricfx5uj-24mt\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-24mt\/esMatch-

Node

mitsubishielectricfx5uj-24mt\/ess_firmwareMatch-

AND

mitsubishielectricfx5uj-24mt\/essMatch-

Node

mitsubishielectricfx5uj-40mr\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-40mr\/esMatch-

Node

mitsubishielectricfx5uj-40mt\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-40mt\/esMatch-

Node

mitsubishielectricfx5uj-40mt\/ess_firmwareMatch-

AND

mitsubishielectricfx5uj-40mt\/essMatch-

Node

mitsubishielectricfx5uj-60mr\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-60mr\/esMatch-

Node

mitsubishielectricfx5uj-60mt\/es_firmwareMatch-

AND

mitsubishielectricfx5uj-60mt\/esMatch-

Node

mitsubishielectricfx5uj-60mt\/ess_firmwareMatch-

AND

mitsubishielectricfx5uj-60mt\/essMatch-

Node

mitsubishielectricfx5uc-32mt\/dss-ts_firmwareMatch-

AND

mitsubishielectricfx5uc-32mt\/dss-tsMatch-

Node

mitsubishielectricfx5uc-32mt\/ds-ts_firmwareMatch-

AND

mitsubishielectricfx5uc-32mt\/ds-tsMatch-

Node

mitsubishielectricfx5uj_firmwareMatch-

AND

mitsubishielectricfx5ujMatch-

CPENameOperatorVersion
mitsubishielectric:fx5uc_firmwaremitsubishielectric fx5uc firmwareeq-

CPE	Name	Operator	Version
mitsubishielectric:fx5uc_firmware	mitsubishielectric fx5uc firmware	eq	-

CNA Affected

[
  {
    "product": "Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions"
      },
      {
        "status": "affected",
        "version": "Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions"
      }
    ]
  }
]

References

jvn.jp/vu/JVNVU96577897/index.html

www.cisa.gov/uscert/ics/advisories/icsa-22-090-04

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.3%

JSON

Related for CVE-2022-25160

nvd1 ptsecurity1 cvelist1 nessus1 prion1 ics1