Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2022-23127: Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior a

40
This month
MEDIUM 6.1UPGRADEUPGRADE

CVE-2022-23127 is a medium-severity flaw (CVSS 6.1) affecting mobilehmi, mc works64. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileH

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.1 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance1.6% (top 24%)
CISA exploited listNo
WeaknessCWE-79
Published2022-01-21
Last modified2026-06-17
Publisher (CNA): Mitsubishi Electric Corporation · Vendor: iconics · mitsubishielectric

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

iconics mobilehmi UPGRADE
Affected: <= 10.96.2
Fixed in: newer than 10.96.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy mobilehmi || rpm -q mobilehmi || mobilehmi --version
2. UPGRADE to newer than 10.96.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mobilehmi
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mobilehmi
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mitsubishielectric mc works64 UPGRADE
Affected: < 10.95.210.01
Fixed in: 10.95.210.01
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy mc-works64 || rpm -q mc-works64 || mc-works64 --version
2. UPGRADE to 10.95.210.01 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mc-works64
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mc-works64
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-23127?

mobilehmi: upgrade to newer than 10.96.2; mc works64: upgrade to 10.95.210.01. Exact commands for each OS are on this page.

Is CVE-2022-23127 being exploited?

CVE-2022-23127 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-23127 affect?

CVE-2022-23127 affects mobilehmi, mc works64. Severity is medium (CVSS 6.1). Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an

How urgent is CVE-2022-23127?

Priority 40/100. No elevated risk signals yet.

Software pages

Mitsubishi Electric vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.