CVE-2022-23128
First published: Fri Jan 21 2022(Updated: )
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ICONICS AnalytiX | >=10.95.3<=10.97 | |
| ICONICS GENESIS64 | >=10.95.3<=10.97 | |
| ICONICS Hyper Historian | >=10.95.3<=10.97 | |
| ICONICS MobileHMI | >=10.95.3<=10.97 | |
| Mitsubishielectric Mc Works64 | >=10.95.201.23<=10.95.210.01 | |
| ICONICS and Mitsubishi Electric ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI For CVE-2022-23127 (Cross-site Scripting CWE-79) All versions up to and including 10.96.2 For CVE-2022-23128 (Incomplete List of Disallowed Inputs CWE-184) All versions from 10.95.3 to 10.97 For CVE-2022-23129 (Plaintext Storage of a Password CWE-256) All versions from 10.90 to 10.97 For CVE-2022-23130 (Buffer Over-read CWE-126) All versions up to and including 10.97 | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23127 (Cross-site Scripting CWE-79) All versions up to and including 10.96.2 | ||
| ICONICS and Mitsubishi Electric All versions up to and including 10.96.2 | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23128 (Incomplete List of Disallowed Inputs CWE-184) All versions from 10.95.3 to 10.97 | ||
| ICONICS and Mitsubishi Electric All versions from 10.95.3 to 10.97 | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23129 (Plaintext Storage of a Password CWE-256) All versions from 10.90 to 10.97 | ||
| ICONICS and Mitsubishi Electric All versions from 10.90 to 10.97 | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23130 (Buffer Over-read CWE-126) All versions up to and including 10.97 | ||
| ICONICS and Mitsubishi Electric All versions up to and including 10.97 | ||
| ICONICS and Mitsubishi Electric Mitsubishi Electric MC Works64 For CVE-2022-23127 (Cross-site Scripting CWE-79) All versions prior to 4.04E (10.95.210.01) For CVE-2022-23128 (Incomplete List of Disallowed Inputs CWE-184) MC Works64: Version 4.00A (v10.95.201.23) to 4.04E (v10.95.210.01) For CVE-2022-23129 (Plaintext Storage of a Password CWE-256) All versions prior to 4.04E (10.95.210.01) For CVE-2022-23130 (Buffer Over-read CWE-126) MC Works64: Version 4.00A (v10.95.201.23) to 4.04E (v10.95.210.01) | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23127 (Cross-site Scripting CWE-79) All versions prior to 4.04E (10.95.210.01) | ||
| ICONICS and Mitsubishi Electric All versions prior to 4.04E (10.95.210.01) | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23128 (Incomplete List of Disallowed Inputs CWE-184) MC Works64: Version 4.00A (v10.95.201.23) to 4.04E (v10.95.210.01) | ||
| ICONICS and Mitsubishi Electric MC Works64: Version 4.00A (v10.95.201.23) to 4.04E (v10.95.210.01) | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23129 (Plaintext Storage of a Password CWE-256) All versions prior to 4.04E (10.95.210.01) | ||
| ICONICS and Mitsubishi Electric For CVE-2022-23130 (Buffer Over-read CWE-126) MC Works64: Version 4.00A (v10.95.201.23) to 4.04E (v10.95.210.01) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-23128.
What is the severity of CVE-2022-23128?
CVE-2022-23128 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2022-23128?
The affected software versions are Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97, and ICONICS MobileHMI.
What is the recommended action to fix CVE-2022-23128?
To fix CVE-2022-23128, it is recommended to apply the patches or updates provided by Mitsubishi Electric and ICONICS.
Where can I find more information about CVE-2022-23128?
You can find more information about CVE-2022-23128 at the following references: [https://jvn.jp/vu/JVNVU95403720/index.html](https://jvn.jp/vu/JVNVU95403720/index.html), [https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01](https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01), [https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/weakness
- agent/references
- agent/severity
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/iconics
- canonical/iconics analytix
- version/iconics analytix/10.95.3
- version/iconics analytix/10.97
- canonical/iconics genesis64
- version/iconics genesis64/10.95.3
- version/iconics genesis64/10.97
- canonical/iconics hyper historian
- version/iconics hyper historian/10.95.3
- version/iconics hyper historian/10.97
- canonical/iconics mobilehmi
- version/iconics mobilehmi/10.95.3
- version/iconics mobilehmi/10.97
- vendor/mitsubishielectric
- canonical/mitsubishielectric mc works64
- version/mitsubishielectric mc works64/10.95.201.23
- version/mitsubishielectric mc works64/10.95.210.01
- vendor/iconics and mitsubishi electric
- canonical/iconics and mitsubishi electric iconics suite including genesis64, hyper historian, analytix, and mobilehmi for cve-2022-23127 (cross-site scripting cwe-79) all versions up to and including 10.96.2 for cve-2022-23128 (incomplete list of disallowed inputs cwe-184) all versions from 10.95.3 to 10.97 for cve-2022-23129 (plaintext storage of a password cwe-256) all versions from 10.90 to 10.97 for cve-2022-23130 (buffer over-read cwe-126) all versions up to and including 10.97
- canonical/iconics and mitsubishi electric for cve-2022-23127 (cross-site scripting cwe-79) all versions up to and including 10.96.2
- canonical/iconics and mitsubishi electric all versions up to and including 10.96.2
- canonical/iconics and mitsubishi electric for cve-2022-23128 (incomplete list of disallowed inputs cwe-184) all versions from 10.95.3 to 10.97
- canonical/iconics and mitsubishi electric all versions from 10.95.3 to 10.97
- canonical/iconics and mitsubishi electric for cve-2022-23129 (plaintext storage of a password cwe-256) all versions from 10.90 to 10.97
- canonical/iconics and mitsubishi electric all versions from 10.90 to 10.97
- canonical/iconics and mitsubishi electric for cve-2022-23130 (buffer over-read cwe-126) all versions up to and including 10.97
- canonical/iconics and mitsubishi electric all versions up to and including 10.97
- canonical/iconics and mitsubishi electric mitsubishi electric mc works64 for cve-2022-23127 (cross-site scripting cwe-79) all versions prior to 4.04e (10.95.210.01) for cve-2022-23128 (incomplete list of disallowed inputs cwe-184) mc works64: version 4.00a (v10.95.201.23) to 4.04e (v10.95.210.01) for cve-2022-23129 (plaintext storage of a password cwe-256) all versions prior to 4.04e (10.95.210.01) for cve-2022-23130 (buffer over-read cwe-126) mc works64: version 4.00a (v10.95.201.23) to 4.04e (v10.95.210.01)
- canonical/iconics and mitsubishi electric for cve-2022-23127 (cross-site scripting cwe-79) all versions prior to 4.04e (10.95.210.01)
- canonical/iconics and mitsubishi electric all versions prior to 4.04e (10.95.210.01)
- canonical/iconics and mitsubishi electric for cve-2022-23128 (incomplete list of disallowed inputs cwe-184) mc works64: version 4.00a (v10.95.201.23) to 4.04e (v10.95.210.01)
- canonical/iconics and mitsubishi electric mc works64: version 4.00a (v10.95.201.23) to 4.04e (v10.95.210.01)
- canonical/iconics and mitsubishi electric for cve-2022-23129 (plaintext storage of a password cwe-256) all versions prior to 4.04e (10.95.210.01)
- canonical/iconics and mitsubishi electric for cve-2022-23130 (buffer over-read cwe-126) mc works64: version 4.00a (v10.95.201.23) to 4.04e (v10.95.210.01)