CVE-2022-23127

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Mitsubishi Electric MC Works64; ICONICS MobileHMI	Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior; ICONICS MobileHMI versions 10.96.2 and prior

References

https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdfMitigation, Vendor Advisory

Timeline

Published: Jan 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-231289.8Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), CVE-2022-231295.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6 CVE-2022-23137.3A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and o CVE-2022-231305.5Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p CVE-2022-231319.8In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, beca CVE-2022-231327.3During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case CVE-2022-231335.4An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is CVE-2022-231345.3After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users a CVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinat CVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters a CVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and wh CVE-2022-231387.5ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, an