CVE-2022-25164

—

CVSS 3.1

7.5 high

EPSS

<1%p55

Published

Nov 25, 2022 (Nov 25, 2022)

Modified

Jun 17, 2026

Description

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.

Vendors: mitsubishielectric
Products: gx works3, mx opc ua module configurator-r
Weakness: CWE-312
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news1 stories

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The Hacker NewsDec 3, 04:17 UTC · Dec 3, 2022Vulnerability CVE-2022-25164 CVE-2022-29830 CVE-2022-29831+2 CVEs