CVE-2022-33315 Vulnerability Details

Record summary

CVE-2022-33315 has a selected CVSS score of 7.8 (high).

Description

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

Description source: CVE List

Affected products and versions

Product	Source	Version range	Status
GENESIS64 Browse Mitsubishi Electric / GENESIS64 Default status: unaffected	CVE List	Versions 10.97 to 10.97.1	affected
ICONICS Suite Browse Mitsubishi Electric / ICONICS Suite Default status: unaffected	CVE List	Versions 10.97 to 10.97.1	affected
MC Works64 Browse Mitsubishi Electric / MC Works64 Default status: unaffected	CVE List	Versions 4.04E and prior	affected
GENESIS64 Browse Mitsubishi Electric Iconics Digital Solutions / GENESIS64 Default status: unaffected	CVE List	Versions 10.97 to 10.97.1	affected
ICONICS Suite Browse Mitsubishi Electric Iconics Digital Solutions / ICONICS Suite Default status: unaffected	CVE List	Versions 10.97 to 10.97.1	affected

References

jvn.jpGovernment resource

https://jvn.jp/vu/JVNVU96480474/index.html

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-33315

cisa.govGovernment resource

https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04

mitsubishielectric.comVendor advisory

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf