CVE-2022-33318

published 2022-07-20

CVE-2022-33318: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
iconics	genesis64	—	—
iconics	genesis64	—	—
mitsubishi_electric	genesis32	—	—
mitsubishi_electric	genesis64	—	—
mitsubishi_electric	iconics_suite	—	—
mitsubishi_electric	mc_works64	—	—
mitsubishi_electric_iconics_digital_solutions	genesis32	—	—
mitsubishi_electric_iconics_digital_solutions	genesis64	—	—
mitsubishi_electric_iconics_digital_solutions	iconics_suite	—	—
mitsubishielectric	mc_works64	<= 10.95.210.01	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502