CVE-2022-40264

Name of the Vulnerable Software and Affected Versions ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2

Description The issue allows an unauthenticated attacker to create, tamper with, or destroy arbitrary files by getting a legitimate user to import a project package file crafted by the attacker. This is due to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' issue.

Recommendations For ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2, consider restricting the import of project package files from untrusted sources until a patch is available. As a temporary workaround, avoid using the project package file import feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.