CVE-2022-23130Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and…
- 5.9MediumCVSS base score
- 1.0%Exploitation in 30 daysEPSS · top 37% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 and prior, Mitsubishi Electric ICONICS Suite versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 and prior, Mitsubishi Electric GENESIS32 versions 9.7 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64, ICONICS Suite, MC Works64, or GENESIS32 and execute commands against the database from GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.
Timeline
ID reserved
By Mitsubishi
- 10 days later
· 10 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| MitsubishiCNA (assigner) | 3.1 | Medium5.9 | CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.0% · top 37% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Affected products
Mitsubishi Electric Corporation · GENESIS64
- affected Versions 10.97 and prior
Mitsubishi Electric Iconics Digital Solutions · GENESIS64
- affected Versions 10.97 and prior
Mitsubishi Electric Corporation · ICONICS Suite
- affected Versions 10.97 and prior
Mitsubishi Electric Iconics Digital Solutions · ICONICS Suite
- affected Versions 10.97 and prior
Mitsubishi Electric Corporation · MC Works64
- affected Versions 4.00A to 4.04E
Mitsubishi Electric Corporation · GENESIS32
- affected Versions 9.7 or prior
Mitsubishi Electric Iconics Digital Solutions · GENESIS32
- affected Versions 9.7 or prior
References
References3
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-028_en.pdf (opens in a new tab)vendor-advisoryx_refsource_MISCx_transferred
- https://jvn.jp/vu/JVNVU95403720/index.html (opens in a new tab)government-resourcex_refsource_MISCx_transferred
- https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01 (opens in a new tab)government-resourcex_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-28221 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-23130)Record last updated .