Lucene search

[email protected]CVE-2022-29833

HistoryNov 25, 2022 - 12:15 a.m.

CVE-2022-29833

2022-11-2500:15:00

CWE-522

[email protected]

web.nvd.nist.gov

cve-2022-29833

insufficiently protected credentials

mitsubishi electric corporation gx works3

vulnerability

remote unauthenticated attacker

sensitive information disclosure

melsec safety cpu modules

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.008 Low

EPSS

Percentile

81.8%

JSON

Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally.

CPENameOperatorVersion
mitsubishielectric:gx_works3mitsubishielectric gx works3eq*
mitsubishielectric:gx_works3mitsubishielectric gx works3le1.086q

CPE	Name	Operator	Version
mitsubishielectric:gx_works3	mitsubishielectric gx works3	eq	*
mitsubishielectric:gx_works3	mitsubishielectric gx works3	le	1.086q

References

jvn.jp/vu/JVNVU97244961

www.cisa.gov/uscert/ics/advisories/icsa-22-333-05

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf

Social References

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.008 Low

EPSS

Percentile

81.8%

JSON

Related for CVE-2022-29833

prion1 ics1