CVE-2022-29834: Mitsubishi Electric GENESIS64 / ICONICS Suite Mobile-Monitoring Path Traversal (Water/Wastewater SCADA-HMI)

CVE-2022-29834 is a path traversal vulnerability (CWE-22) in the mobile monitoring function of Mitsubishi Electric GENESIS64 and ICONICS Suite, a SCADA/HMI platform ICONICS markets for the water and wastewater industry among other critical infrastructure sectors: a remote, unauthenticated attacker can embed a malicious URL parameter in a monitoring-screen URL served to the mobile monitoring application to disclose arbitrary files from the GENESIS64/ICONICS Suite server, and NVD rates the flaw 7.5 (high) on CVSS v3.1.

CVE-2022-29834 (CWE-22, path traversal) affects Mitsubishi Electric GENESIS64 and ICONICS Suite, SCADA/HMI software that ICONICS lists as serving the "Water and Wastewater" industry alongside energy, transportation and other smart-infrastructure verticals (ICONICS Digital Solutions).

NVD's description states: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1 ... allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen" (NVD).

NVD's Primary CVSS v3.1 score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, low attack complexity, no privileges or user interaction required, confidentiality-only impact consistent with file disclosure rather than modification or denial of service; Mitsubishi Electric's own PSIRT submission recorded an identical Secondary score and vector (NVD).

Mitsubishi Electric's Vulnerability Advisory 2022-008 (released 19 July 2022) bundles CVE-2022-29834 with six related CVEs disclosed the same day — CVE-2022-33315, -33316, -33317, -33318, -33319 and -33320, covering deserialization, script-inclusion and out-of-bounds-read flaws across GENESIS64, ICONICS Suite, MC Works64 and GENESIS32 — and states that exploiting the path traversal "may result in information disclosure" by an attacker who leads a user to open a crafted monitoring-screen link. The advisory's remediation for GENESIS64/ICONICS Suite is to apply the "10.97 Critical Fixes Rollup 4" or "10.97.1 Critical Fixes Rollup 3" security updates via the ICONICS Community Portal, and recommends isolating control-system networks behind firewalls and not clicking links or opening attachments from untrusted sources as an interim mitigation (Mitsubishi Electric Vulnerability Advisory 2022-008).

The vulnerability is also tracked by Japan's JPCERT/CC-IPA coordinated vulnerability database as JVNVU#96480474, which cross-references CISA's ICS advisory ICSA-22-202-04, "ICONICS Suite and Mitsubishi Electric MC Works64 Products" (JVN JVNVU#96480474).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01715 (77.6th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

Operators running GENESIS64 or ICONICS Suite 10.97 through 10.97.1 — including water/wastewater utilities using it for SCADA visualization and mobile monitoring — should apply the vendor's Critical Fixes Rollup updates and avoid opening monitoring-screen links from untrusted sources in the mobile monitoring app until patched.

• A path traversal vulnerability in the mobile monitoring function of GENESIS64/ICONICS Suite 10.97 to 10.97.1 lets a remote unauthenticated attacker disclose arbitrary server files via a malicious URL parameter in a monitoring-screen URL. — NVD
• NVD Primary CVSS v3.1 score 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; Mitsubishi Electric PSIRT recorded an identical Secondary score and vector. — NVD
• Mitsubishi Electric Vulnerability Advisory 2022-008 (19 July 2022) bundles CVE-2022-29834 with six related CVEs and directs GENESIS64/ICONICS Suite users to the 10.97 Critical Fixes Rollup 4 / 10.97.1 Critical Fixes Rollup 3 security updates. — Mitsubishi Electric Vulnerability Advisory 2022-008
• Tracked as JVNVU#96480474, which cross-references CISA ICS advisory ICSA-22-202-04, "ICONICS Suite and Mitsubishi Electric MC Works64 Products." — JVN JVNVU#96480474
• ICONICS lists "Water and Wastewater" among the Smart Infrastructure industries its SCADA/HMI products, including GENESIS64/ICONICS Suite, serve. — ICONICS Digital Solutions
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01715 (77.6th percentile) as of 2026-11-08. — FIRST EPSS