CVE-2022-25164 Information disclosure in GX Works3

What is CVE-2022-25164?

CVE-2022-25164 is a high-severity vulnerability in Mitsubishi Electric Corporation GX Works3, published on 24 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.

Weakness: CWE-312

Which versions are affected by CVE-2022-25164?

It affects 2 products.

Products include Mitsubishielectric Gx Works3, Mitsubishielectric Mx Opc Ua Module Configurator-R.

How do I fix CVE-2022-25164?

No fix has been published for CVE-2022-25164 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-25164 being exploited?

There is no known exploitation of CVE-2022-25164 in the wild and no public exploit code.

Other vulnerabilities in Mitsubishi Electric Corporation GX Works3

• CVE-2023-4088 Malicious Code Execution Vulnerability in FA Engineering Software Products Critical 9.3
• CVE-2022-29830 Hardcoded credentials in GX Works3 Critical 9.1
• CVE-2023-5247 Path traversal in GX Works3 High 7.8
• CVE-2022-29831 Hardcoded credentials in GX Works3 High 7.5
• CVE-2022-29826 Information disclosure in GX Works3 Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m3pg-8xj4-p62w.