CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
78.1%
Successful exploitation of these vulnerabilities could result in information disclosure, remote code execution, or a denial-of-service condition.
The following SCADA products are affected:
ICONICS MobileHMI and IoTWorX IoT Visualizer products are affected by a path traversal vulnerability. If exploited, then this could allow traversing of the file system and access to files or directories that are outside the restricted directory on the MobileHMI server or the IoTWorX IoT Visualizer server. This traversal could then result in information disclosure.
CVE-2022-29834 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.
CVE-2022-33315 and CVE-2022-33316 have been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
GraphWorX64 scripting, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, is based on JScript and .NET. It stores script code in the GraphWorX64 project files. These project files could be directly edited that could result in code execution if exploited.
CVE-2022-33317 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains a deserialization vulnerability that could result in remote code execution if exploited.
CVE-2022-33318 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains an out-of-bounds read issue which could result in information disclosure or a denial-of-service condition if exploited.
CVE-2022-33319 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
All ICONICS Suite and Mitsubishi Electric MC Works64 products contain a deserialization vulnerability that could enable malicious project configuration files to execute arbitrary code via XML code on the files.
CVE-2022-33320 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Chris Anastasio, Noam Moshe of Claroty Research, Steven Seeley, Alex Birmberg, Ben McBride, and Axel β0vercl0kβ Souchet, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.
ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite and MC Works64 software with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required) and MC Works64 security patches may be found here.
ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollup releases and security patches. Refer to the ICONICS Whitepaper on Security Vulnerabilities, the most recent version of which can be found here, and to the Mitsubishi Electricβs security advisory for information on the availability of the security updates. Note: ICONICS and Mitsubishi Electric products version 10.97.2 and later are not vulnerable to these exploits.
ICONICS and Mitsubishi Electric recommend users of these products take the following mitigation steps:
Mitsubishi Electric also recommends specific action for specific versions of MC Works64:
Additional information and useful links are found on the ICONICS GENESIS64 security updates page.
Additional information and useful links are found on Mitsubishi Electricβs security advisory.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability these vulnerabilities. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29834
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33315
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33316
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33317
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33317
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33319
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33320
cisa.gov/ics
cisa.gov/ics
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
cwe.mitre.org/data/definitions/125.html
cwe.mitre.org/data/definitions/22.html
cwe.mitre.org/data/definitions/502.html
cwe.mitre.org/data/definitions/502.html
cwe.mitre.org/data/definitions/502.html
cwe.mitre.org/data/definitions/829.html
iconics.com/certs
iconics.com/Support/CERT-MC-Works
iconics.force.com/community
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=ICONICS%20Suite%20and%20Mitsubishi%20Electric%20MC%20Works64%20Products+https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
us-cert.cisa.gov/ics/Recommended-Practices
us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04&title=ICONICS%20Suite%20and%20Mitsubishi%20Electric%20MC%20Works64%20Products
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
www.iconics.com/certs
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=ICONICS%20Suite%20and%20Mitsubishi%20Electric%20MC%20Works64%20Products&body=www.cisa.gov/news-events/ics-advisories/icsa-22-202-04