CVE-2022-29831: High severity mitsubishi electric gx works3 vulnerability

Published Nov 24, 2022

Updated

Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.

Affected Software

22 affected components

Mitsubishielectric Gx Works3>=1.015r<=1.086q

Mitsubishielectric Gx Works3>=1.087r

Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830) 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 --------- 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830)

Mitsubishi Electric 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 ---------

Mitsubishi Electric 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric GX Works3: 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works2: All versions (affected by CVE-2022-29832)

: Mitsubishi Electric GX Developer: 8.40S or later (affected by CVE-2022-29832)

: Mitsubishi Electric GT Designer3 Version1 (GOT2000): 1.122C to 1.290C (affected by CVE-2022-29825 and CVE-2022-29829)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.000A to 1.033K (affected by CVE-2022-29826 and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.035M to 1.042U (affected by CVE-2022-29826, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.045X to 1.065T (affected by CVE-2022-29830)

: Mitsubishi Electric MT Works2: 1.100E to 1.200J (affected by CVE-2022-29825 and CVE-2022-29829)

Event History

Nov 24, 2022

CVE Published

via MITRE·11:36 PM

Data Sourced

via MITRE·11:36 PM

DescriptionSeverityWeakness

Nov 26, 2025

Data Sourced

via ICS·07:11 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-333-05

Frequently Asked Questions

What is CVE-2022-29831?

CVE-2022-29831 is a use of hard-coded password vulnerability in Mitsubishi Electric Corporation GX Works3 software.

How severe is CVE-2022-29831?

CVE-2022-29831 has a severity rating of 7.5 (high).

What is affected by CVE-2022-29831?

Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z are affected by CVE-2022-29831.

How can a remote unauthenticated attacker exploit CVE-2022-29831?

A remote unauthenticated attacker can exploit CVE-2022-29831 to obtain information about the project file for MELSEC safety CPU modules.

Are there any references for CVE-2022-29831?

Yes, you can find references for CVE-2022-29831 at the following links: [Reference 1](https://jvn.jp/vu/JVNVU97244961), [Reference 2](https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05), [Reference 3](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf).