CVE-2022-29830 Hardcoded credentials in GX Works3

What is CVE-2022-29830?

CVE-2022-29830 is a critical vulnerability in Mitsubishi Electric Corporation GX Works3, published on 24 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.

Weakness: CWE-798, CWE-321

Which versions are affected by CVE-2022-29830?

It affects 1 product.

Products include Mitsubishielectric Gx Works3.

How do I fix CVE-2022-29830?

No fix has been published for CVE-2022-29830 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-29830 being exploited?

There is no known exploitation of CVE-2022-29830 in the wild and no public exploit code.

Other vulnerabilities in Mitsubishi Electric Corporation GX Works3

• CVE-2023-4088 Malicious Code Execution Vulnerability in FA Engineering Software Products Critical 9.3
• CVE-2022-25164 Information disclosure in GX Works3 High 8.6
• CVE-2023-5247 Path traversal in GX Works3 High 7.8
• CVE-2022-29831 Hardcoded credentials in GX Works3 High 7.5
• CVE-2022-29826 Information disclosure in GX Works3 Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3p64-2ppg-fm8m.