CVE-2022-29834

HIGH

Mitsubishi Electric GENESIS64 and ICONICS Suite 10.97-10.97.1 - Path Traversal via Monitoring Screen

Title source: llm
STIX 2.1

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen.

References (3)

Core 3
Core References
Third Party Advisory government-resource
https://jvn.jp/vu/JVNVU96480474/index.html
Third Party Advisory, US Government Resource government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04

Scores

CVSS v3 7.5
EPSS 0.0130
EPSS Percentile 66.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (2)
iconics/genesis64 10.97
iconics/genesis64 10.97.1
Published Jul 20, 2022
Tracked Since Feb 18, 2026