CVE-2022-33315

published 2022-07-20

CVE-2022-33315: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions…

Priority P3 43 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
iconics	genesis64	—	—
iconics	genesis64	—	—
mitsubishi_electric	genesis64	—	—
mitsubishi_electric	iconics_suite	—	—
mitsubishi_electric	mc_works64	—	—
mitsubishi_electric_iconics_digital_solutions	genesis64	—	—
mitsubishi_electric_iconics_digital_solutions	iconics_suite	—	—
mitsubishielectric	mc_works64	<= 10.95.210.01	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502