Deserialization in Iconics Genesis64
CVE-2022-33320
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
Vulnerability class: Insecure Deserialization
EPSS: 0.005 (38.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Iconics Genesis64 — versions 10.97, 10.97.1
- Mitsubishi Electric Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Suite — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Mc Works64 — versions Versions 4.04E and prior
- Mitsubishielectric Mc_works64
- Mitsubishi Electric Iconics Digital Solutions Genesis64 — versions Versions 10.97 to 10.97.1
- Mitsubishi Electric Iconics Digital Solutions Suite — versions Versions 10.97 to 10.97.1
Weakness classification (CWE)
References
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (vendor-advisory, Third Party Advisory)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Third Party Advisory, government-resource)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (government-resource)
Frequently asked questions
- What is CVE-2022-33320?
- CVE-2022-33320 is a high-severity vulnerability in Iconics Genesis64, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2022-07-20.
- How severe is CVE-2022-33320?
- High severity. CVSS v3 base score is 7.8 out of 10.