CVE-2022-40264: Path Traversal

Reference Links

• https://iconics.com/About/Security/CERT
• https://jvn.jp/vu/JVNVU95858406/index.html
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-22-347-01 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-22-347-01

Frequently Asked Questions

• What is CVE-2022-40264?

  CVE-2022-40264 is an 'Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)' vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2.

• What is the severity of CVE-2022-40264?

  The severity of CVE-2022-40264 is high with a CVSS score of 7.1.

• How can an attacker exploit CVE-2022-40264?

  An unauthenticated attacker can exploit CVE-2022-40264 by getting a legitimate user to import a project package, allowing them to create, tamper with, or destroy arbitrary files.

• Which software versions are affected by CVE-2022-40264?

  ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 are affected by CVE-2022-40264.

• How can I mitigate the impact of CVE-2022-40264?

  To mitigate the impact of CVE-2022-40264, it is recommended to update to a version beyond 10.97.2 or apply the necessary security patches provided by ICONICS/Mitsubishi Electric.