CVE-2022-23128: Critical severity iconics and mitsubishi electric iconics suite including genesis64, hyper historian, analytix, and mobilehmi for cve-2022-23127 (cross-site scripting cwe-79) all versions up to and including 10.96.2 for cve-2022-23128 (incomplete list of disallowed inputs cwe-184) all versions from 10.95.3 to 10.97 for cve-2022-23129 (plaintext storage of a password cwe-256) all versions from 10.90 to 10.97 for cve-2022-23130 (buffer over-read cwe-126) all versions up to and including 10.97 vulnerability
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-23128.
What is the severity of CVE-2022-23128?
CVE-2022-23128 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2022-23128?
The affected software versions are Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97, and ICONICS MobileHMI.
What is the recommended action to fix CVE-2022-23128?
To fix CVE-2022-23128, it is recommended to apply the patches or updates provided by Mitsubishi Electric and ICONICS.
Where can I find more information about CVE-2022-23128?
You can find more information about CVE-2022-23128 at the following references: [https://jvn.jp/vu/JVNVU95403720/index.html](https://jvn.jp/vu/JVNVU95403720/index.html), [https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01](https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01), [https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf).