ICS Advisory

ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update A)

Last Revised
Alert Code
ICSA-22-202-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v3 9.8
  • ATTENTION: Low attack complexity
  • Vendor: Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric
  • Equipment: ICONICS Product Suite, MC Works64
  • Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere, Out-of-Bounds Read

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in information disclosure, remote code execution, or a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following SCADA products are affected:

  • GENESIS64TM: Version 10.97 to 10.97.1
  • MC Works64: Version 4.04E and prior (excluding CVE-2022-29834)

3.2 Vulnerability Overview

3.2.1 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

ICONICS MobileHMI and IoTWorX IoT Visualizer products are affected by a path traversal vulnerability. If exploited, then this could allow traversing of the file system and access to files or directories that are outside the restricted directory on the MobileHMI server or the IoTWorX IoT Visualizer server. This traversal could then result in information disclosure.

CVE-2022-29834 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.2.2 DESERIALIZATION OF UNTRUSTED DATA CWE-502

GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.

CVE-2022-33315 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.3 DESERIALIZATION OF UNTRUSTED DATA CWE-502

GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.

CVE-2022-33316 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.4 INCLUSION OF FUNCTIONALITY FROM UNTRUSTED CONTROL SPHERE CWE-829

GraphWorX64 scripting, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, is based on JScript and .NET. It stores script code in the GraphWorX64 project files. These project files could be directly edited that could result in code execution if exploited.

CVE-2022-33317 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.5 DESERIALIZATION OF UNTRUSTED DATA CWE-502

GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains a deserialization vulnerability that could result in remote code execution if exploited.

CVE-2022-33318 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.6 OUT-OF-BOUNDS READ CWE-125

GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains an out-of-bounds read issue which could result in information disclosure or a denial-of-service condition if exploited.

CVE-2022-33319 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

3.2.7 DESERIALIZATION OF UNTRUSTED DATA CWE-502

All ICONICS Suite and Mitsubishi Electric MC Works64 products contain a deserialization vulnerability that could enable malicious project configuration files to execute arbitrary code via XML code on the files.

CVE-2022-33320 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States, Japan

3.4 RESEARCHER

Chris Anastasio, Noam Moshe of Claroty Research, Steven Seeley, Alex Birmberg, Ben McBride, and Axel '0vercl0k' Souchet, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.

4. MITIGATIONS

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:

For GENESIS64TM users, please update your software by using the GENESIS64TM security patches. The following are instructions for downloading security patches.

The security patch for GENESIS64TM can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in "SupportWorX License Information", which is shipped with the product.

For MC Works64 users, There are no plans to release a security patch or a countermeasure version. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64TM. For information on how to replace, please refer to the document below:

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security patches) cannot be implemented.

  • Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.
  • Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.

Additional information and useful links are found on the ICONICS GENESIS64 security updates page.

Additional information and useful links are found on Mitsubishi Electric's security advisory.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

  • July 26, 2022: Initial Republication of Mitsubishi Electric Advisory
  • July 24, 2025: Update A - Updates to affected vendors, products and versions, CVE score, and mitigations.

This product is provided subject to this Notification and this Privacy & Use policy.

Vendor

  • ICONICS, Mitsubishi Electric

Tags

Sector: Critical Manufacturing Sector
Topics: Industrial Control System Vulnerabilities, Industrial Control Systems

Please share your thoughts

We recently updated our anonymous product survey; we welcome your feedback.

Related Advisories