CVE-2022-33319

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Mitsubishi Electric	GENESIS64	Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Versions 10.97 to 10.97.1
Mitsubishi Electric	GENESIS32	Versions 9.7 and prior
Mitsubishi Electric Iconics Digital Solutions	GENESIS32	Versions 9.7 and prior
Mitsubishi Electric	MC Works64	Versions 4.04E and prior

References

https://jvn.jp/vu/JVNVU96480474/index.htmlThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdfThird Party Advisory
https://jvn.jp/vu/JVNVU96480474/index.htmlThird Party Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdfThird Party Advisory

Timeline

Published: Jul 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-33329.8A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an unknown part of the CVE-2022-333207.8Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi CVE-2022-333219.8Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Elec CVE-2022-333226.1Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HE CVE-2022-333237.5Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Serie CVE-2022-333247.5Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32 CVE-2022-333259.8Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-craft CVE-2022-333269.8Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-craft CVE-2022-333279.8Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-craft CVE-2022-333289.8Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-craft CVE-2022-333299.8Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-craft CVE-2022-33335.4A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of th