High severity · published Dec 23, 2022
CVE-2022-33324
Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
MELIPC Series MI5122-VW · Mitsubishi Electric Corporation
Firmware versions "07" and prior · source: vendor
MI
MELSEC iQ-L Series L04HCPU · Mitsubishi Electric Corporation
Firmware versions "05" and prior · source: vendor
MI
MELSEC iQ-L Series L08HCPU · Mitsubishi Electric Corporation
Firmware versions "05" and prior · source: vendor
MI
MELSEC iQ-L Series L16HCPU · Mitsubishi Electric Corporation
Firmware versions "05" and prior · source: vendor
MI
MELSEC iQ-L Series L32HCPU · Mitsubishi Electric Corporation
Firmware versions "05" and prior · source: vendor
MI
MELSEC iQ-R Series R00CPU · Mitsubishi Electric Corporation
Firmware versions "32" and prior · source: vendor
MI
MELSEC iQ-R Series R01CPU · Mitsubishi Electric Corporation
Firmware versions "32" and prior · source: vendor
MI
MELSEC iQ-R Series R02CPU · Mitsubishi Electric Corporation
Firmware versions "32" and prior · source: vendor
MI
MELSEC iQ-R Series R04CPU · Mitsubishi Electric Corporation
Firmware versions "65" and prior · source: vendor
MI
MELSEC iQ-R Series R04ENCPU · Mitsubishi Electric Corporation
Firmware versions "65" and prior · source: vendor
MI
MELSEC iQ-R Series R08CPU · Mitsubishi Electric Corporation
Firmware versions "65" and prior · source: vendor
MI
MELSEC iQ-R Series R08ENCPU · Mitsubishi Electric Corporation
Firmware versions "65" and prior · source: vendor
Affected product
MS
MELIPC Series MI5122-VW
Mitsubishi Electric Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-33324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-33324
Third Party Advisory
https://jvn.jp/vu/JVNVU96883262
Patch
https://www.cisa.gov/uscert/ics/advisories/icsa-22-356-03
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-018_en.pdf
More from MELIPC Series MI5122-VW
8.8
CVE-2024-3904
Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to…