CVE-2022-29832: Medium severity mitsubishi electric gx works3 vulnerability

Published Nov 24, 2022

Updated

Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.

Affected Software

22 affected components

Mitsubishielectric Gx Works3>=1.015r<=1.086q

Mitsubishielectric Gx Works3>=1.087r

Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830) 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 --------- 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830)

Mitsubishi Electric 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833) --------- Begin Update B Part 1 of 2 ---------

Mitsubishi Electric 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works3: 1.000A to 1.011M (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric GX Works3: 1.015R to 1.087R (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29826, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.090U (affected by CVE-2022-25164, CVE-2022-29825, CVE-2022-29827, CVE-2022-29828, CVE-2022-29829, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.095Z (affected by CVE-2022-25164, CVE-2022-29827, CVE-2022-29828, CVE-2022-29830, CVE-2022-29831, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric GX Works3: 1.096A and later (affected by CVE-2022-29827, CVE-2022-29828, CVE-2022-29832, CVE-2022-29833)

: Mitsubishi Electric MX OPC UA Module Configurator-R: 1.08J and prior (affected by CVE-2022-25164)

: Mitsubishi Electric GX Works2: All versions (affected by CVE-2022-29832)

: Mitsubishi Electric GX Developer: 8.40S or later (affected by CVE-2022-29832)

: Mitsubishi Electric GT Designer3 Version1 (GOT2000): 1.122C to 1.290C (affected by CVE-2022-29825 and CVE-2022-29829)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.000A to 1.033K (affected by CVE-2022-29826 and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.035M to 1.042U (affected by CVE-2022-29826, CVE-2022-29829, and CVE-2022-29830)

: Mitsubishi Electric Motion Control Settings (GX Works3 related software): 1.045X to 1.065T (affected by CVE-2022-29830)

: Mitsubishi Electric MT Works2: 1.100E to 1.200J (affected by CVE-2022-29825 and CVE-2022-29829)

Event History

Nov 24, 2022

CVE Published

via MITRE·11:37 PM

Data Sourced

via MITRE·11:37 PM

DescriptionSeverityWeakness

Nov 26, 2025

Data Sourced

via ICS·07:11 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-333-05

Frequently Asked Questions

What is CVE-2022-29832?

CVE-2022-29832 is a vulnerability in Mitsubishi Electric Corporation GX Works3, GX Works2, and GX Developer that allows a remote attacker to disclose sensitive information.

What is the severity of CVE-2022-29832?

The severity of CVE-2022-29832 is medium, with a CVSS score of 6.5.

Which versions of Mitsubishi Electric Corporation GX Works3 are affected by CVE-2022-29832?

Versions 1.015R to 1.086q of Mitsubishi Electric Corporation GX Works3 are affected by CVE-2022-29832.

Is authentication required for an attacker to exploit CVE-2022-29832?

No, authentication is not required for an attacker to exploit CVE-2022-29832.

How can I fix CVE-2022-29832?

To fix CVE-2022-29832, update GX Works3, GX Works2, and GX Developer to versions 1.087r or later.