Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI | Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01); ICONICS GENESIS64 versions 10.95.3 to 10.97; ICONICS Hyper Historian versions 10.95.3 to 10.97; ICONICS AnalytiX versions 10.95.3 to 10.97; ICONICS MobileHMI versions 10.95.3 to 10.97 | — | No fix listed | CNA |
- Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI Vendor— Affected Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01); ICONICS GENESIS64 versions 10.95.3 to 10.97; ICONICS Hyper Historian versions 10.95.3 to 10.97; ICONICS AnalytiX versions 10.95.3 to 10.97; ICONICS MobileHMI versions 10.95.3 to 10.97 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:iconics:analytix:*:*:*:*:*:*:*:* | 10.95.3 – 10.97 | Vulnerable | Mitsubishi Electric Iconics Digital Solutions |
| cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:* | 10.95.3 – 10.97 | Vulnerable | Mitsubishi Electric Iconics Digital Solutions |
| cpe:2.3:a:iconics:hyper_historian:*:*:*:*:*:*:*:* | 10.95.3 – 10.97 | Vulnerable | Mitsubishi Electric Iconics Digital Solutions |
| cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:* | 10.95.3 – 10.97 | Vulnerable | Mitsubishi Electric Iconics Digital Solutions |
| cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* | 10.95.201.23 – 10.95.210.01 | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:iconics:analytix:*:*:*:*:*:*:*:* Versions 10.95.3 – 10.97 Vulnerable ·Mitsubishi Electric Iconics Digital Solutions
- cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:* Versions 10.95.3 – 10.97 Vulnerable ·Mitsubishi Electric Iconics Digital Solutions
- cpe:2.3:a:iconics:hyper_historian:*:*:*:*:*:*:*:* Versions 10.95.3 – 10.97 Vulnerable ·Mitsubishi Electric Iconics Digital Solutions
- cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:* Versions 10.95.3 – 10.97 Vulnerable ·Mitsubishi Electric Iconics Digital Solutions
- cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:* Versions 10.95.201.23 – 10.95.210.01 Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23128
- 2026-10-03 Alias added: GHSA-63gj-7jw2-qccf
References
Sources
- CVE-2022-23128 · CVE Program
- CVE-2022-23128 · NVD
- FIRST EPSS
- GHSA-63gj-7jw2-qccf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences