CVE-2022-25164: High severity mitsubishi electric gx works3 vulnerability

Published Nov 24, 2022

Updated

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.

Affected Software

24 affected components

Mitsubishielectric Gx Works3>=1.000a<=1.011m

Mitsubishielectric Gx Works3>=1.015r<=1.086q

Mitsubishielectric Gx Works3>=1.087r

Mitsubishielectric Mx Opc Ua Module Configurator-r

Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830) 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 --------- 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830)

Mitsubishi Electric 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 ---------

Mitsubishi Electric 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric GX Works3: 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works2: All versions (affected by CVE-2022-29832)

: Mitsubishi Electric GX Developer: 8.40S or later (affected by CVE-2022-29832)

: Mitsubishi Electric GT Designer3 Version1 (GOT2000): 1.122C to 1.290C (affected by CVE-2022-29825 and CVE-2022-29829)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.000A to 1.033K (affected by CVE-2022-29826 and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.035M to 1.042U (affected by CVE-2022-29826, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.045X to 1.065T (affected by CVE-2022-29830)

: Mitsubishi Electric MT Works2: 1.100E to 1.200J (affected by CVE-2022-29825 and CVE-2022-29829)

Event History

Nov 24, 2022

CVE Published

via MITRE·11:21 PM

Data Sourced

via MITRE·11:21 PM

DescriptionSeverityWeakness

Nov 26, 2025

Data Sourced

via ICS·07:11 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-333-05

Frequently Asked Questions

What is CVE-2022-25164?

CVE-2022-25164 is a vulnerability that allows a remote unauthenticated attacker to disclose sensitive information in Mitsubishi Electric GX Works3 versions 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior.

How severe is CVE-2022-25164?

CVE-2022-25164 has a severity rating of 7.5 (High).

Which software versions are affected by CVE-2022-25164?

Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior are affected by CVE-2022-25164.

How can an attacker exploit CVE-2022-25164?

An unauthenticated remote attacker can exploit CVE-2022-25164 to disclose sensitive information.

Are there any fixes or patches available for CVE-2022-25164?

It is recommended to refer to the official advisories and documentation provided by Mitsubishi Electric for information on available fixes or patches for CVE-2022-25164.