CVE-2022-23129

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when configuration information of GridWorX, a database linkage function of GENESIS64 and MC Works64, is exported to a CSV file, the authentication information is saved in plaintext, and an attacker who can access this CSV file can gain the authentication information.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	Mitsubishi Electric MC Works64; ICONICS GENESIS64	Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior; ICONICS GENESIS64 versions 10.90 to 10.97

References

https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-027_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-027_en.pdfMitigation, Vendor Advisory

Timeline

Published: Jan 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-23137.3A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and o CVE-2022-231305.5Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p CVE-2022-231319.8In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, beca CVE-2022-231327.3During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case CVE-2022-231335.4An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is CVE-2022-231345.3After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users a CVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinat CVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters a CVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and wh CVE-2022-231387.5ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, an CVE-2022-231398.8ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is incon CVE-2022-23149.8The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.