CVE-2022-29832

LOW

Mitsubishi Electric Corporation GX Works3 <1.015R - Info Disclosure

Title source: llm
STIX 2.1

Description

Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry government-resource
https://jvn.jp/vu/JVNVU97244961
Third Party Advisory, US Government Resource government-resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05

Scores

CVSS v3 3.7
EPSS 0.0019
EPSS Percentile 40.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-316 CWE-312
Status published
Products (1)
mitsubishielectric/gx_works3 1.015r - 1.086q
Published Nov 25, 2022
Tracked Since Feb 18, 2026