← Vulnerability feed

Vulnerability record · CVE-2022-23128 · published 21 January 2022

CVE-2022-23128: Iconics analytix vulnerability

Iconics · Analytix

Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.

9.8 CVSS 3.1 Critical EPSS 2.9% · top 13.7%
9.8CVSS 3.1 base score, v2 7.5
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU95403720/index.html MitigationThird Party AdvisoryVDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 MitigationThird Party AdvisoryUS Government ResourceVDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf MitigationVendor Advisory
https://jvn.jp/vu/JVNVU95403720/index.html MitigationThird Party AdvisoryVDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 MitigationThird Party AdvisoryUS Government ResourceVDB Entry
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf MitigationVendor Advisory

Track CVE-2022-23128 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-6943Mitsubishielectric ezsocket vulnerabilityUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions…EPSS 2.1%9.8CVE-2022-33318Mitsubishi Electric GENESIS64 and MC Works64 deserialization RCEGENESIS64, ICONICS Suite, GENESIS32 and MC Works64 contain a deserialization of untrusted data flaw (CWE-502). A remote attacker can send specially c…EPSS 48%analysed9.8CVE-2020-12007Mitsubishielectric mc works deserialization of untrusted data vulnerabilityA specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a de…EPSS 3.9%9.8CVE-2020-12011Mitsubishielectric mc works out-of-bounds write vulnerabilityA specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This …EPSS 29%9.1CVE-2022-33319Iconics genesis64 out-of-bounds read vulnerabilityOut-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 …EPSS 1.6%9.1CVE-2020-12013Mitsubishielectric mc works32 code injection vulnerabilityA specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi El…EPSS 3.0%7.8CVE-2024-7587Iconics genesis64 incorrect default permissions vulnerabilityIncorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 an…EPSS 0.19%7.8CVE-2022-33315Iconics genesis64 deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solut…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2022-23128), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.