Security readout for executives and security teams
Plain-English summary
This vulnerability affects Mitsubishi Electric engineering and design software used around industrial control projects. A hard-coded cryptographic key can let an unauthenticated remote attacker disclose sensitive project information. Business risk is exposure of programs and project files, with possible unauthorized program execution according to the CVE description. No provided source shows active exploitation.
Executive priority
Treat as a moderate-priority industrial engineering exposure issue. It is not KEV-listed in the provided data, but confidentiality loss from project files can weaken operational security and expose proprietary automation logic.
Technical view
CVE-2022-29829 is CWE-321 in GX Works3, GT Designer3 Version1 (GOT2000), Motion Control Setting, and MT Works2 specified version ranges. It has CVSS 3.1 score 6.8 with network attack vector, high attack complexity, no privileges, no user interaction, scope change, and high confidentiality impact.
Likely exposure
Exposure is most likely on engineering workstations or environments using the affected Mitsubishi Electric software versions, especially where project files or program data are reachable over networks. The supplied data does not prove internet exposure or affected runtime controllers.
Exploitation context
The source bundle describes remote unauthenticated sensitive information disclosure from hard-coded cryptographic keys. It does not include exploit code, observed exploitation, or CISA KEV status. High attack complexity reduces likelihood, but the potential impact is meaningful for industrial engineering assets.
Researcher notes
Focus validation on exact product/version matching and data exposure paths. The bundle identifies affected ranges and CVSS, but does not provide fixed versions, exploitation evidence, or environmental prerequisites beyond remote unauthenticated access and high complexity.
Mitigation direction
- Inventory Mitsubishi engineering software and compare versions against the affected ranges.
- Review Mitsubishi Electric advisory 2022-015 for vendor-specified updates or workarounds.
- Prioritize remediation on systems handling sensitive PLC, GOT, motion, or project files.
- Limit network reachability to engineering workstations while vendor guidance is applied.
- Protect project files with access controls and monitor unusual access attempts.
Validation and detection
- Confirm installed versions of GX Works3, GT Designer3, Motion Control Setting, and MT Works2.
- Map where affected software stores or accesses project and program files.
- Check whether any affected systems are reachable from untrusted networks.
- Review logs for unexplained project file access or unauthorized program activity.
- Document remediation status against Mitsubishi and CISA advisory references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-321: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-29829 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N2.24Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdfCVE reference · vendor-advisory
- https://jvn.jp/vu/JVNVU97244961/index.htmlCVE reference · government-resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.