Lucene search

MitsubishiCVE-2022-23129

HistoryJan 21, 2022 - 7:15 p.m.

CVE-2022-23129

2022-01-2119:15:10

CWE-312

Mitsubishi

web.nvd.nist.gov

cve-2022-23129

mitsubishi electric

mc works64

iconics

genesis64

plaintext storage

password vulnerability

database security

authentication

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

5.3%

JSON

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when configuration information of GridWorX, a database linkage function of GENESIS64 and MC Works64, is exported to a CSV file, the authentication information is saved in plaintext, and an attacker who can access this CSV file can gain the authentication information.

Affected configurations

Nvd

Node

iconicsgenesis64Range10.90–10.97

mitsubishielectricmc_works64Range<10.95.210.01

VendorProductVersionCPE
iconicsgenesis64*cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*
mitsubishielectricmc_works64*cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
iconics	genesis64	*	cpe:2.3:a:iconics:genesis64::::::::
mitsubishielectric	mc_works64	*	cpe:2.3:a:mitsubishielectric:mc_works64::::::::

CNA Affected

[
  {
    "product": "Mitsubishi Electric MC Works64; ICONICS GENESIS64",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
      },
      {
        "status": "affected",
        "version": "ICONICS GENESIS64 versions 10.90 to 10.97"
      }
    ]
  }
]

References

jvn.jp/vu/JVNVU95403720/index.html

us-cert.cisa.gov/ics/advisories/icsa-22-020-01

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-027_en.pdf

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

5.3%

JSON

Related for CVE-2022-23129