CVE-2022-23130

Vulnerability

A buffer over-read vulnerability (CWE-126) exists in the database server component of Mitsubishi Electric GENESIS64, ICONICS Suite, MC Works64, and GENESIS32 when processing stored procedures. The affected versions are: - GENESIS64 ≤ 10.97 - ICONICS Suite ≤ 10.97 - MC Works64 4.00A to 4.04E - GENESIS32 ≤ 9.7

A legitimate user must import a configuration file containing specially crafted stored procedures into the product and then execute commands against the database from the affected software [1][2].

Exploitation

The attacker must have network adjacency to the target system (CVSSv3 vector AV:A) and requires high privileges with user interaction. The attack complexity is high. The exploitation sequence is: the attacker crafts a configuration file with malicious stored procedures, convinces a legitimate user to import it into the SCADA product, and then waits for the user to execute database commands from the affected software. The buffer over-read occurs when the database server processes the malicious stored procedures [1][2].

Impact

Successful exploitation causes a denial-of-service (DoS) condition in the database server (SQL Server), potentially disrupting SCADA operations. The CVSSv3.1 score is 5.9 (Medium) with availability impact rated as high, while integrity impact is low and confidentiality impact is none [1][2].

Mitigation

Mitsubishi Electric has released updates to address this vulnerability. For GENESIS64 and ICONICS Suite, update to a version later than 10.97. For MC Works64, update beyond version 4.04E. For GENESIS32, update beyond version 9.7. Refer to the vendor's advisory for specific patch details [2]. If immediate patching is not possible, restrict network access to affected systems and avoid importing configuration files from untrusted sources.