CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-23128
https://notcve.org/view.php?id=CVE-2022-23128
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products. Una vulnerabilidad "Incomplete List of Disallowed Inputs" en Mitsubishi Electric MC Works64 versiones 4.00A (10.95.201.23) a 4.04E (10.95.210.01), ICONICS GENESIS64 versiones 10.95.3 a 10.97, ICONICS Hyper Historian versiones 10.95.3 a 10.97, ICONICS AnalytiX versiones 10.95.3 a 10.97 e ICONICS MobileHMI versiones 10. 95.3 a 10.97 permite a un atacante remoto no autenticado omitir la autenticación de MC Works64, GENESIS64, Hyper Historian, AnalytiX y MobileHMI, y conseguir acceso no autorizado a los productos, mediante el envío de paquetes WebSocket especialmente diseñados al servidor FrameWorX, una de las funciones de los productos • https://jvn.jp/vu/JVNVU95403720/index.html https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23130
https://notcve.org/view.php?id=CVE-2022-23130
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.97 and prior and ICONICS Hyper Historian versions 10.97 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64 or MC Works64 and execute commands against the database from GENESIS64 or MC Works64. Una vulnerabilidad de lectura excesiva del búfer en Mitsubishi Electric MC Works64 versiones 4.00A (10.95.201.23) a 4.04E (10.95.210.01), en ICONICS GENESIS64 versiones 10.97 y anteriores, y en ICONICS Hyper Historian versiones 10.97 y anteriores, permite a un atacante causar una condición de denegación de servicio en el servidor de la base de datos al hacer que un usuario legítimo importe un archivo de configuración que contenga procedimientos almacenados especialmente diseñados en GENESIS64 o MC Works64 y ejecute comandos contra la base de datos desde GENESIS64 o MC Works64 • https://jvn.jp/vu/JVNVU95403720/index.html https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01 https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-028_en.pdf • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-12013 – ICONICS Genesis64 TestQuery SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12013
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Un cliente WCF especialmente diseñado que interactúa con el puede permitir la ejecución de determinados comandos SQL arbitrarios remotamente. Esto afecta: Mitsubishi Electric MC Works64 Versión 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión v10.96 y anteriores; ICONICS GenBroker32 versión v9.5 y anteriores The vulnerablity allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests to the TestQuery endpoint of the IcoFwxServer service. • https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 4%CPEs: 11EXPL: 0CVE-2020-12011 – ICONICS Genesis64 VariantClear Out-Of-Bounds Access Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12011
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior. Un paquete de comunicación especialmente diseñado enviado a los sistemas afectados podría causar una condición de denegación de servicio o permitir una ejecución de código remota. Este problema afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión 10.96 y anteriores; GenBroker32 versión 9.5 y anteriores This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of indexes. • https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-12015 – ICONICS Genesis64 IcoFwxServer Deserialization Of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12015
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Un paquete de comunicación especialmente diseñado enviado a los sistemas afectados podría causar una condición de denegación de servicio debido a una deserialización inapropiada. Este problema afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión v10.96 y anteriores; ICONICS GenBroker32 versión 9.5 y anteriores This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability. The specific flaw exists with the handling of serialized objects. • https://www.us-cert.gov/ics/advisories/icsa-20-170-02 https://www.us-cert.gov/ics/advisories/icsa-20-170-03 • CWE-502: Deserialization of Untrusted Data •