Mitsubishi Electric MC Works64 Configuration File buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Mitsubishi Electric MC Works64, ICONICS GENESIS64 and ICONICS Hyper Historian. The affected element is an unknown function of the component Configuration File Handler. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-23130. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Mitsubishi Electric MC Works64, ICONICS GENESIS64 and ICONICS Hyper Historian (affected version not known) and classified as critical. This issue affects some unknown functionality of the component Configuration File Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. The summary by CVE is:

Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 and prior, Mitsubishi Electric ICONICS Suite versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 and prior, Mitsubishi Electric GENESIS32 versions 9.7 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64, ICONICS Suite, MC Works64, or GENESIS32 and execute commands against the database from GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

The weakness was disclosed 01/22/2022 as icsa-22-020-01. The advisory is shared at us-cert.cisa.gov. The identification of this vulnerability is CVE-2022-23130 since 01/11/2022. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Mitsubishi Electric

Name

• ICONICS GENESIS64
• ICONICS Hyper Historian
• MC Works64

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion