CVE-2022-40264: 
Mitsubishi Electric ICONICS GENESIS64 vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2022-40264) was discovered in ICONICS and Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2. The vulnerability allows an unauthenticated attacker to create, tamper with, or destroy arbitrary files by getting a legitimate user to import a crafted project package file (CISA Advisory, NVD).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability (CWE-22). A crafted PKGX file could force ICONICS Workbench to write an arbitrary file through path traversal. The vulnerability has been assigned a CVSS v3 base score of 6.3 with the vector string (AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N), indicating local attack vector, low attack complexity, no privileges required, and user interaction required (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to write arbitrary files on the target system. The vulnerability affects the ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI, potentially impacting critical manufacturing infrastructure (CISA Advisory).

The vulnerability requires user interaction and is not exploitable remotely. No known public exploits specifically target this vulnerability. The vulnerability was reported by Noam Moshe of Claroty Research, working with Trend Micro Zero Day Initiative (CISA Advisory).

ICONICS and Mitsubishi Electric recommend updating to version 10.97.2 CFR1 or later, which are not vulnerable. For systems without patches, users should: only unpack files from trusted sources, protect and encrypt Pack&Go packages with passwords, and avoid unpacking package files using relative paths. Additional mitigation steps include placing control system networks behind firewalls, isolating them from untrusted networks, and minimizing network exposure (CISA Advisory).