Vulnerability in Mitsubishielectric L02cpu
CVE-2022-24946
Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number "24051" and prior and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.017 (76.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: +0.000
Affected products
- Mitsubishielectric L02cpu
- Mitsubishielectric L02cpu Firmware
- Mitsubishielectric L02cpu-P
- Mitsubishielectric L02cpu-P Firmware
- Mitsubishielectric L02scpu
- Mitsubishielectric L02scpu Firmware
- Mitsubishielectric L02scpu-P
- Mitsubishielectric L02scpu-P Firmware
- Mitsubishielectric L06cpu
- Mitsubishielectric L06cpu Firmware
Weakness classification (CWE)
References
- www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf (Vendor Advisory)
- jvn.jp/vu/JVNVU90895626/index.html (Third Party Advisory)
- www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
Frequently asked questions
- What is CVE-2022-24946?
- CVE-2022-24946 is a high-severity vulnerability in Mitsubishielectric L02cpu, classified under Improper Locking. CVSS score: 7.5/10. Published 2022-06-15.
- How severe is CVE-2022-24946?
- High severity. CVSS v3 base score is 7.5 out of 10.