High severity · published Feb 2, 2023
CVE-2022-33323
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rh-12fh55 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12fh70 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12fh85 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sdh55 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sdh70 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sdh85 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sqh55 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sqh70 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-12sqh85 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-20fh100 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-20fh85 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
RF
Rh-20sdh100 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-33323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-33323
Third Party Advisory
https://jvn.jp/vu/JVNVU94588481/index.html
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-05
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdf
