CVE-2022-29829

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	from 1.000A to 1.090U
Mitsubishi Electric Corporation	GT Designer3 Version1 (GOT2000)	from 1.122C to 1.290C
Mitsubishi Electric Corporation	Motion Control Setting(GX Works3 related software)	from 1.035M to 1.042U
Mitsubishi Electric Corporation	MT Works2	from 1.100E to 1.200J

References

https://jvn.jp/vu/JVNVU97244961/index.htmlThird Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU97244961/index.htmlThird Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdfMitigation, Vendor Advisory

Timeline

Published: Nov 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-29834.8The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to per CVE-2022-298309.1Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Settin CVE-2022-298317.5Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthe CVE-2022-298326.5Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, G CVE-2022-298336.5Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote un CVE-2022-298347.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 CVE-2022-298355.3WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create for CVE-2022-298364.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digit CVE-2022-298377.8A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attack CVE-2022-298384.6Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure d CVE-2022-298395.5Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an CVE-2022-29845.5In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.