CVE-2022-29832

Vulnerability

A cleartext storage of sensitive information in memory vulnerability exists in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions, and GX Developer versions 8.40S and later [1][2]. The vulnerability allows sensitive data related to project files for MELSEC safety CPU modules or project files with security settings for MELSEC Q/FX/L series to be stored in an unencrypted manner in memory [1]. Affected software includes GX Works3 (versions 1.015R through 1.087R, 1.090U, 1.095Z, 1.096A and later), GX Works2 (all versions), and GX Developer (8.40S or later) [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by gaining access to the memory of the engineering software while it is running or in a crash dump. No authentication or user interaction is required for the attacker to retrieve the cleartext sensitive information from the affected process's memory [1]. The attack complexity is low and can be performed remotely without special network position beyond reachability to the device running the software [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to disclose sensitive information contained in project files for MELSEC safety CPU modules or project files for MELSEC Q/FX/L series that have security settings applied [1]. This information disclosure could compromise the confidentiality of industrial control system configuration and security credentials, potentially enabling further attacks on the control network [1].

Mitigation

Mitsubishi Electric has released updated versions of GX Works3 to address this vulnerability, though specific fixed version numbers were not provided in the available references. Users should contact Mitsubishi Electric support or consult the vendor's advisory for the latest patched releases [1]. For GX Works2 and GX Developer, users are advised to upgrade to the latest supported versions or apply any available patches as recommended by the vendor. No workarounds have been disclosed, and this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].