Vulnerability in Mitsubishielectric Gx Works3
CVE-2022-29832
Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Mitsubishielectric Gx Works3
- Mitsubishi Electric Corporation Gx Developer — versions 8.40S and later
- Mitsubishi Electric Corporation Gx Works2 — versions all versions
- Mitsubishi Electric Corporation Gx Works3 — versions 1.015R and later
Weakness classification (CWE)
References
- www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf (vendor-advisory, Mitigation, Vendor Advisory)
- jvn.jp/vu/JVNVU97244961 (VDB Entry, Third Party Advisory, government-resource)
- www.cisa.gov/uscert/ics/advisories/icsa-22-333-05 (government-resource)
Frequently asked questions
- What is CVE-2022-29832?
- CVE-2022-29832 is a low-severity vulnerability in Mitsubishielectric Gx Works3, classified under CWE-316. CVSS score: 3.7/10. Published 2022-11-25.
- How severe is CVE-2022-29832?
- Low severity. CVSS v3 base score is 3.7 out of 10.