CVE-2022-29831

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-259 CWE-798

Affected software

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	from 1.015R to 1.095Z

References

https://jvn.jp/vu/JVNVU97244961Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU97244961Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdfMitigation, Vendor Advisory

Timeline

Published: Nov 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298326.5Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, G CVE-2022-298336.5Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote un CVE-2022-298347.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 CVE-2022-298355.3WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create for CVE-2022-298364.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digit CVE-2022-298377.8A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attack CVE-2022-298384.6Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure d CVE-2022-298395.5Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an CVE-2022-29845.5In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.CVE-2022-298405.5Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the CVE-2022-298419.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that r CVE-2022-298429.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute co