CVE-2022-23130

Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 and prior, Mitsubishi Electric ICONICS Suite versions 10.97 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 and prior, Mitsubishi Electric GENESIS32 versions 9.7 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64, ICONICS Suite, MC Works64, or GENESIS32 and execute commands against the database from GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

• CWE-126
• CWE-125

• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-028_en.pdfMitigation, Vendor Advisory
• https://jvn.jp/vu/JVNVU95403720/index.htmlMitigation, Third Party Advisory, VDB Entry
• https://us-cert.cisa.gov/ics/advisories/icsa-22-020-01Mitigation, Third Party Advisory, US Government Resource, VDB Entry
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-028_en.pdfMitigation, Vendor Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23125This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2022-23126TeslaMate before 1.25.1 (when using the default Docker confi…9.8
• CVE-2022-23127Cross-site Scripting vulnerability in Mitsubishi Electric MC…6.1
• CVE-2022-23128Incomplete List of Disallowed Inputs vulnerability in Mitsub…9.8
• CVE-2022-23129Plaintext Storage of a Password vulnerability in Mitsubishi …5.5
• CVE-2022-2313A DLL hijacking vulnerability in the MA Smart Installer for …7.3
• CVE-2022-23131In the case of instances where the SAML SSO authentication i…9.8
• CVE-2022-23132During Zabbix installation from RPM, DAC_OVERRIDE SELinux ca…7.3
• CVE-2022-23133An authenticated user can create a hosts group from the conf…5.4
• CVE-2022-23134After the initial setup process, some steps of setup.php fil…5.3
• CVE-2022-23135There is a directory traversal vulnerability in some home ga…6.5
• CVE-2022-23136There is a stored XSS vulnerability in ZTE home gateway prod…5.4