CVE-2022-29833

Vulnerability

CVE-2022-29833 is an insufficiently protected credentials vulnerability in Mitsubishi Electric GX Works3 engineering software versions 1.015R and later. Affected versions include 1.015R to 1.087R, 1.090U, 1.095Z, and 1.096A and later. The vulnerability allows an attacker to disclose sensitive credentials stored insecurely by the software [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability without any special privileges or user interaction. By sending crafted network requests or leveraging the insufficiently protected credential storage mechanism, the attacker can retrieve sensitive information [1].

Impact

Successful exploitation leads to disclosure of credentials, which can then be used to gain unauthorized access to MELSEC iQ-R/F/L series CPU modules and MELSEC safety CPU modules. This could allow the attacker to view and execute programs or view project files without proper permissions [1].

Mitigation

Mitsubishi Electric recommends updating GX Works3 to the latest version. Fixed versions are available from the vendor. Users should also implement network segmentation and restrict access to the engineering software as a workaround [1].