SB2022113011 - Multiple vulnerabilities in Mitsubishi Electric FA Engineering Software
Published: November 30, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Cleartext storage of sensitive information (CVE-ID: CVE-2022-25164)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to cleartext storage of sensitive information. A remote attacker can disclose sensitive information.
2) Use of Hard-coded Password (CVE-ID: CVE-2022-29825)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the software contains a hard-coded password. A local user can disclose sensitive information in the system.
3) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-29827)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product has a hardcoded cryptographic key. A remote attacker can disclose sensitive information on the system.
4) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-29828)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product has a hardcoded cryptographic key. A remote attacker can disclose sensitive information on the system.
5) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-29829)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product has a hardcoded cryptographic key. A remote attacker can disclose sensitive information on the system.
6) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-29830)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product has a hardcoded cryptographic key. A remote attacker can disclose sensitive information on the system.
7) Use of Hard-coded Password (CVE-ID: CVE-2022-29831)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the software contains a hard-coded password. A remote attacker can obtain information about the safety CPU module project file.
8) Cleartext storage of sensitive information (CVE-ID: CVE-2022-29832)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to cleartext storage of sensitive information. A remote attacker can obtain information about the safety CPU module project file.
9) Insufficiently protected credentials (CVE-ID: CVE-2022-29833)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficiently protected credentials. A remote attacker can gain access to sensitive information.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.