Cross-site scripting in Mitsubishi Electric MC Works64; ICONICS MobileHMI
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Mitsubishi Electric MC Works64; ICONICS MobileHMI | Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior; ICONICS MobileHMI versions 10.96.2 and prior | — | No fix listed | CNA |
- Mitsubishi Electric MC Works64; ICONICS MobileHMI Vendor— Affected Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior; ICONICS MobileHMI versions 10.96.2 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:* | up to 10.96.2 | Vulnerable | Mitsubishi Electric Iconics Digital Solutions |
| cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* | before 10.95.210.01 | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:* Versions up to 10.96.2 Vulnerable ·Mitsubishi Electric Iconics Digital Solutions
- cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* Versions before 10.95.210.01 Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23127
- 2026-10-03 Alias added: GHSA-3ccx-8rq3-28hx
References
Sources
- CVE-2022-23127 · CVE Program
- CVE-2022-23127 · NVD
- FIRST EPSS
- GHSA-3ccx-8rq3-28hx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences