CVE-2022-23128

Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.

• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdfMitigation, Vendor Advisory
• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdfMitigation, Vendor Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23122This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23123This vulnerability allows remote attackers to disclose sensi…9.8
• CVE-2022-23124This vulnerability allows remote attackers to disclose sensi…9.8
• CVE-2022-23125This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23126TeslaMate before 1.25.1 (when using the default Docker confi…9.8
• CVE-2022-23127Cross-site Scripting vulnerability in Mitsubishi Electric MC…6.1
• CVE-2022-23129Plaintext Storage of a Password vulnerability in Mitsubishi …5.5
• CVE-2022-2313A DLL hijacking vulnerability in the MA Smart Installer for …7.3
• CVE-2022-23130Buffer Over-read vulnerability in Mitsubishi Electric MC Wor…5.5
• CVE-2022-23131In the case of instances where the SAML SSO authentication i…9.8
• CVE-2022-23132During Zabbix installation from RPM, DAC_OVERRIDE SELinux ca…7.3
• CVE-2022-23133An authenticated user can create a hosts group from the conf…5.4