CVE-2022-40264

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by getting a legitimate user import a project package file crafted by the attacker.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
ICONICS and Mitsubishi Electric Corporation	GENESIS64	versions 10.96 to 10.97.2

References

https://iconics.com/About/Security/CERTVendor Advisory
https://jvn.jp/vu/JVNVU95858406/index.htmlThird Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdfMitigation, Vendor Advisory
https://iconics.com/About/Security/CERTVendor Advisory
https://jvn.jp/vu/JVNVU95858406/index.htmlThird Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdfMitigation, Vendor Advisory

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-402657.5Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and M CVE-2022-402666.5Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi CVE-2022-402679.1Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=CVE-2022-402684.7Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.CVE-2022-402698.1Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000 CVE-2022-40275.4The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum r CVE-2022-402747.8Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown fi CVE-2022-402765.5Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious ma CVE-2022-402777.8Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markd CVE-2022-402787.5An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.CVE-2022-402797.5An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packe CVE-2022-40285.4The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profi