Skip to main content
No exploitation reportedFix available

CVE-2022-29830

No exploitation reported by the sources we read.

  • Published2022-11-25
  • WeaknessCWE-321 · CWE-798

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.

Timeline

dates in UTC
  1. 2022-11-2500:15CVE publishedNVD

Observed activity

isMalicious corpus · updated 2026-10-23 21:37 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2022-29830?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2022-29830?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD
Mitsubishielectric gx works3
BranchAffectedFixed in
1.x≥ 1.000a, ≤ 1.011mno fix published
1.x≥ 1.015r, ≤ 1.086qno fix published
1.87+≥ 1.087rno fix published

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-22-333-05 CISA7 known affected

    Mitsubishi Electric FA Engineering Software (Update C)

    Mitsubishi Electric GX Works3: >=1.000A|<1.011M · Mitsubishi Electric GX Works3: >=1.015R|<1.087R · Mitsubishi Electric GX Works3: 1.090U · +4 more

Full record on NVD

Fix

  1. Vendor fix CISA ICSA-22-333-05 · 4 productsGX Works3:
  2. Vendor fix CISA ICSA-22-333-05 · 4 productsCVE-2022-29830: Download fixed Ver. 1.070Y or later and update the software. Set security version for project to "2". Refer "Motion Control Setting Function Help" – "12.5. Preventing Illegal Access to/Falsification of Data (Security Version)" for details. Apply the countermeasure for CVE-2022-29830…
  3. Mitigation from the vendor CISA ICSA-22-333-05 · 7 productsMitsubishi Electric released and recommends users update to the latest version:
  4. Mitigation from the vendor CISA ICSA-22-333-05 · 7 productsCVE-2022-25164, CVE-2022-29830, and CVE-2022-29831: Download fixed Ver. 1.096A or later. Then set security version for project to "2".
  5. Mitigation from the vendor CISA ICSA-22-333-05 · 7 productsGT Designer3 Version1 (GOT2000):
  6. Mitigation from the vendor CISA ICSA-22-333-05 · 7 productsMotion Control Setting:

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
none listed
PoC-in-GitHub

Sources

  • CISA-ADPSSVC decisionnone2025-04-25
  • OpenCVESSVC decisionnone—
  • CNACVSS 3.19.1read 2026-10-23
  • NVDCVSS 3.19.1read 2026-10-23
  • CNAweakness (CWE)CWE-321read 2026-10-23
  • NVDweakness (CWE)CWE-798read 2026-10-23
  • FIRST EPSSEPSS score1.3 %2026-10-22

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
2022-11-25
Last Modified
2026-06-17
NVD status
Modified

Frequently asked questions

What is CVE-2022-29830?

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.

Is CVE-2022-29830 actively exploited?

Active exploitation of CVE-2022-29830 has not been confirmed. Its EPSS score was 1.3% on 2026-10-22, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-29830?

CVE-2022-29830 has a CVSS v3 base score of 9.1 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database