Mitsubishi Electric GX Works3, which is an integrated engineering software, has recently been discovered to have a major security vulnerability in all versions of its software. The vulnerability, tagged as CVE-2022-29830, is a use of Hard-coded Cryptographic Key that could enable remote unauthenticated attackers to disclose or tamper with sensitive information. This could potentially lead to unauthorized users illegally obtaining confidential data regarding project files.

In this post, we'll detail the vulnerability, discuss the potential impact, and provide various sources of information to help users understand and mitigate the risks associated with CVE-2022-29830.

Vulnerability Details

The CVE-2022-29830 vulnerability originates from the improper use of a Hard-coded Cryptographic Key in the source code of Mitsubishi Electric GX Works3. This key is utilized for encrypting and decrypting sensitive information, including project files and passwords. The weakness resides in the fact that the same key is shared across all installations, making it easier for an attacker to discover and exploit the vulnerability.

Here's a snippet of the vulnerable code demonstrating the use of the hard-coded key

const CRYPT_ALGORITHM = "AES-256-CBC";
const HARDCODED_KEY = "f97a32b7f11a129f81921c73db3ca3d";

function decryptFile(filePath) {
    // load the encrypted data as a buffer
    const encryptedData = fs.readFileSync(filePath);
    // initialize the cipher using the hard-coded key
    const cipher = crypto.createDecipher(CRYPT_ALGORITHM, HARDCODED_KEY);
    // decrypt the data and return the result
    const decryptedData = cipher.update(encryptedData, 'binary', 'utf8') + cipher.final('utf8');
    return decryptedData;
}

Although the code example demonstrates encryption with a hard-coded key, it's vital to understand that utilizing a hard-coded key in any cryptographic process can have severe consequences if the key is exposed.

Exploit Details

To exploit CVE-2022-29830, an attacker would first need to obtain the hard-coded key used for decryption. Once acquired, the attacker can deploy a variety of techniques to compromise the target, such as:

Crafting malicious project files using the hard-coded key and injecting them into the target system.

It's crucial to note that due to the lack of authentication required for this vulnerability, an unauthenticated attacker can perform these attacks remotely.

References

1. Official CVE-2022-29830 page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29830
2. Mitsubishi Electric Advisory: https://www.mitsubishielectric.com/en/assist/security/info/index.page
3. NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-29830

Mitigation

As of now, Mitsubishi Electric has not released any patches for CVE-2022-29830. However, users are recommended to monitor their systems for any suspicious activity and stay vigilant. They can employ best practices such as network segmentation, strong security policies, and regular updates of security software to minimize the risks posed by this vulnerability.

Additionally, users should ensure that only authorized personnel have access to GX Works3 project files, as they contain sensitive information.

Conclusion

CVE-2022-29830 is a serious security issue in Mitsubishi Electric GX Works3, stemming from the use of a hard-coded cryptographic key. It's vital for users to be aware of this vulnerability, understand the potential consequences of exploitation, and apply mitigation techniques until a patch is released.

Stay informed about the latest updates and security advisories pertaining to CVE-2022-29830, and ensure the safety of your valuable project files and sensitive information.

Timeline

Published on: 11/25/2022 00:15:00 UTC
Last modified on: 11/28/2022 20:58:00 UTC