CVE-2022-25164

Vulnerability

Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and MX OPC UA Module Configurator-R versions 1.08J and prior store sensitive information in cleartext [1][2]. This cleartext storage vulnerability (CVE-2022-25164) exposes credentials or other sensitive data that are used to authenticate to MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server module. The vulnerability is present in the engineering software when it handles authentication data for communication with programmable logic controllers (PLCs).

Exploitation

An attacker with network access to a system running an affected version of GX Works3 or MX OPC UA Module Configurator-R can exploit this vulnerability remotely without authentication [1]. No special privileges or user interaction is required. The attacker can read the cleartext sensitive information stored by the software, for example by inspecting configuration files, memory, or network traffic that exposes the unencrypted data [1].

Impact

Successful exploitation allows a remote unauthenticated attacker to disclose sensitive information, specifically credentials used to access MELSEC CPU modules and the MELSEC OPC UA server module [1]. The attacker can then use these credentials to gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module, potentially allowing them to view and execute programs or view project files without proper authorization [1]. This leads to a compromise of confidentiality and integrity of the affected control system.

Mitigation

Mitsubishi Electric has released updated versions to address this vulnerability. For GX Works3, the fixed versions are 1.096A and later (note that version 1.096A and later are not affected by CVE-2022-25164) [1]. For MX OPC UA Module Configurator-R, the fix is incorporated in version 1.09A or later [1]. Users should update to the latest versions of the software as provided by Mitsubishi Electric. No workaround is detailed in the available references. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].