VulnerabilityModified

CVE-2022-23128

CRITICAL 9.8EPSS 2.88%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.88% probability · 86th percentile
CISA KEV: Not listed
Affected: iconics/analytix · iconics/genesis64 · iconics/hyper historian · iconics/mobilehmi · mitsubishielectric/mc works64
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

References

https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdfMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.