« Volver al listado

CVE-2022-25164

Estado: ModificadaAlta (7.5)—

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mitsubishielectric — GX Works3Mitsubishielectric — MX OPC UA Module Configurator-r

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-25164",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-25164",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-25T17:52:39.668512Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "GX Works3",
          "versions": [
            {
              "status": "affected",
              "version": "from 1.000A to 1.095Z"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "MX OPC UA Module Configurator-R",
          "versions": [
            {
              "status": "affected",
              "version": "1.08J and prior"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-11-25T00:15:09.907",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU97244961/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://jvn.jp/vu/JVNVU97244961/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de almacenamiento de texto sin cifrar de información confidencial en Mitsubishi Electric GX Works3 versiones de 1.000A a 1.095Z y Mitsubishi Electric MX OPC UA Module Configurator-R versiones 1.08J y anteriores permite que un atacante remoto no autenticado revele información sensible. Como resultado, atacantes no autenticados pueden obtener acceso no autorizado al módulo de CPU de MELSEC y al módulo de servidor OPC UA de MELSEC."
    }
  ],
  "lastModified": "2026-06-17T04:33:07.910",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A868567B-2BAA-45AE-AEC9-3AFEF2361297",
              "versionEndIncluding": "1.011m",
              "versionStartIncluding": "1.000a"
            },
            {
              "criteria": "cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56BD062B-0D41-42E2-B9EF-B7FBB514CFF9",
              "versionEndIncluding": "1.086q",
              "versionStartIncluding": "1.015r"
            },
            {
              "criteria": "cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7C6A654-1B83-4743-8DDE-B8C5AA5C4D2A",
              "versionStartIncluding": "1.087r"
            },
            {
              "criteria": "cpe:2.3:a:mitsubishielectric:mx_opc_ua_module_configurator-r:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "259C29BF-D845-42E4-8289-BD2FDBE77133"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}