Path traversal in ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX and MobileHMI



| Updated: 2023-04-03
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-40264
CWE-ID CWE-22
Exploitation vector Network
Public exploit N/A
Vulnerable software
 ICONICS Suite
Server applications / SCADA systems

GENESIS64
Server applications / SCADA systems

Energy AnalytiX
Server applications / SCADA systems

Hyper Historian
Client/Desktop applications / Other client software

MobileHMI
Mobile applications / Apps for mobile phones

Vendor ICONICS, Inc.

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Path traversal

EUVDB-ID: #VU70321

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-40264

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can use a specially crafted PKGX file and write arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ICONICS Suite: 10.96 - 10.97.2

GENESIS64: 10.96 - 10.97.2

Hyper Historian: 10.96 - 10.97.2

Energy AnalytiX: 10.96 - 10.97.2

MobileHMI: 10.96 - 10.97.2

CPE2.3 External links

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf
https://jvn.jp/vu/JVNVU95858406/index.html
https://iconics.com/About/Security/CERT
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01
https://www.zerodayinitiative.com/advisories/ZDI-23-342/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###