CVE-2022-23128
Published: 21 January 2022
Summary
CVE-2022-23128 is a critical-severity an unspecified weakness vulnerability in Iconics Analytix. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23128 is an incomplete list of disallowed inputs vulnerability affecting Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) through 4.04E (10.95.210.01) as well as ICONICS GENESIS64, Hyper Historian, AnalytiX, and MobileHMI versions 10.95.3 through 10.97. The flaw resides in the FrameWorX server component and stems from insufficient validation of WebSocket traffic, enabling requests that bypass intended input restrictions.
A remote unauthenticated attacker can exploit the issue by sending specially crafted WebSocket packets directly to the FrameWorX server. Successful exploitation grants full unauthorized access to the affected industrial automation and visualization products, corresponding to the observed CVSS 9.8 rating that reflects network-accessible attack complexity with high impact on confidentiality, integrity, and availability.
Public advisories from CISA (ICSA-22-020-01) and Mitsubishi Electric, along with JVN disclosure JVNVU95403720, document the vulnerability and direct users to vendor guidance for remediation. The associated EPSS score reached a peak of 0.0503 in December 2025 before receding to its current value of 0.0377.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28219
Vulnerability details
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions…
more
10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.