Lucene search

MitsubishiCVELIST:CVE-2022-29827

HistoryNov 24, 2022 - 11:22 p.m.

CVE-2022-29827

2022-11-2423:22:43

CWE-321

Mitsubishi

www.cve.org

mitsubishi electric

gx works3

hard-coded cryptographic key

vulnerability

sensitive information disclosure

remote unauthenticated attackers

programs

project files

illegal execution

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.004

Percentile

72.2%

JSON

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "GX Works3",
    "vendor": "Mitsubishi Electric Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "from 1.000A and later"
      }
    ]
  }
]

References

jvn.jp/vu/JVNVU97244961/index.html

www.cisa.gov/uscert/ics/advisories/icsa-22-333-05

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.004

Percentile

72.2%

JSON

Related for CVELIST:CVE-2022-29827