Out-of-bounds Read in Iconics Genesis64
CVE-2022-33319
Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
EPSS exploit prediction
EPSS: 0.017 (77.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.017 · change: +0.001
Affected products
- Iconics Genesis64 — versions 10.97, 10.97.1
- Mitsubishi Electric Genesis32 — versions Versions 9.7 and prior
- Mitsubishi Electric Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Suite — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Mc Works64 — versions Versions 4.04E and prior
- Mitsubishielectric Mc Works64
- Mitsubishi Electric Iconics Digital Solutions Genesis32 — versions Versions 9.7 and prior
- Mitsubishi Electric Iconics Digital Solutions Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Digital Solutions Suite — versions Versions 10.97 to 10.97.1
Weakness classification (CWE)
References
- www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf (vendor-advisory, Third Party Advisory)
- jvn.jp/vu/JVNVU96480474/index.html (Third Party Advisory, government-resource)
- www.cisa.gov/news-events/ics-advisories/icsa-22-202-04 (government-resource)
Frequently asked questions
- What is CVE-2022-33319?
- CVE-2022-33319 is a high-severity vulnerability in Iconics Genesis64, classified under Out-of-bounds Read. CVSS score: 8.2/10. Published 2022-07-20.
- How severe is CVE-2022-33319?
- High severity. CVSS v3 base score is 8.2 out of 10.