CVE-2022-29828 Hardcoded credentials in GX Works3
Remote attackers can exploit hard-coded keys to view sensitive project files and execute programs in Mitsubishi GX Works3.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29828?
CVE-2022-29828 is a medium-severity vulnerability in Mitsubishi Electric Corporation GX Works3, published on 24 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project file or execute programs illegally.
Which versions are affected by CVE-2022-29828?
It affects 1 product.
Products include Mitsubishielectric Gx Works3.
How do I fix CVE-2022-29828?
No fix has been published for CVE-2022-29828 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-29828 being exploited?
There is no known exploitation of CVE-2022-29828 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation GX Works3
Sources
Also known as GHSA-32fm-h2hh-vxjg.