Deserialization in Iconics Genesis64
CVE-2022-33318
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.
Vulnerability class: Insecure Deserialization
EPSS: 0.481 (98.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Iconics Genesis64 — versions 10.97, 10.97.1
- Mitsubishi Electric Genesis32 — versions Versions 9.7 and prior
- Mitsubishi Electric Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Suite — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Mc Works64 — versions Versions 4.04E and prior
- Mitsubishielectric Mc_works64
- Mitsubishi Electric Iconics Digital Solutions Genesis32 — versions Versions 9.7 and prior
- Mitsubishi Electric Iconics Digital Solutions Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Digital Solutions Suite — versions Versions 10.97 to 10.97.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (vendor-advisory, Third Party Advisory)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Third Party Advisory, government-resource)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (government-resource)
Frequently asked questions
- What is CVE-2022-33318?
- CVE-2022-33318 is a critical-severity vulnerability in Iconics Genesis64, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2022-07-20.
- How severe is CVE-2022-33318?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-33318 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.