CVE-2022-40264
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by getting a legitimate user import a project package file crafted by the attacker.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 0.30% probability · 22th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- iconics/genesis64
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://iconics.com/About/Security/CERTVendor Advisory
- https://jvn.jp/vu/JVNVU95858406/index.htmlThird Party Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdfMitigation, Vendor Advisory
- https://iconics.com/About/Security/CERTVendor Advisory
- https://jvn.jp/vu/JVNVU95858406/index.htmlThird Party Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdfMitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.