CVE-2022-29833 Information disclosure in GX Works3

What is CVE-2022-29833?

CVE-2022-29833 is a medium-severity vulnerability in Mitsubishi Electric Corporation GX Works3, published on 24 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally.

Weakness: CWE-522

Which versions are affected by CVE-2022-29833?

It affects 1 product.

Products include Mitsubishielectric Gx Works3.

How do I fix CVE-2022-29833?

No fix has been published for CVE-2022-29833 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-29833 being exploited?

There is no known exploitation of CVE-2022-29833 in the wild and no public exploit code.

Other vulnerabilities in Mitsubishi Electric Corporation GX Works3

• CVE-2023-4088 Malicious Code Execution Vulnerability in FA Engineering Software Products Critical 9.3
• CVE-2022-29830 Hardcoded credentials in GX Works3 Critical 9.1
• CVE-2022-25164 Information disclosure in GX Works3 High 8.6
• CVE-2023-5247 Path traversal in GX Works3 High 7.8
• CVE-2022-29831 Hardcoded credentials in GX Works3 High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-37x5-q2m2-89q6.