CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.

• CWE-79

• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdfMitigation, Vendor Advisory
• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdfMitigation, Vendor Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23121This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23122This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23123This vulnerability allows remote attackers to disclose sensi…9.8
• CVE-2022-23124This vulnerability allows remote attackers to disclose sensi…9.8
• CVE-2022-23125This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23126TeslaMate before 1.25.1 (when using the default Docker confi…9.8
• CVE-2022-23128Incomplete List of Disallowed Inputs vulnerability in Mitsub…9.8
• CVE-2022-23129Plaintext Storage of a Password vulnerability in Mitsubishi …5.5
• CVE-2022-2313A DLL hijacking vulnerability in the MA Smart Installer for …7.3
• CVE-2022-23130Buffer Over-read vulnerability in Mitsubishi Electric MC Wor…5.5
• CVE-2022-23131In the case of instances where the SAML SSO authentication i…9.8
• CVE-2022-23132During Zabbix installation from RPM, DAC_OVERRIDE SELinux ca…7.3