PT-2022-17002 · Mitsubishi · Melipc Series Mi5122-Vw+10

Published 2022-06-15 · Updated 2022-08-19 · CVE-2022-24946

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V versions 16 and prior Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. 24061 and prior Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. 24061 and prior Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number 24051 and prior Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number 24051 and prior Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number 24051 and prior Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number 24051 and prior Mitsubishi Electric MELIPC Series MI5122-VW versions 05 and prior

Description The issue allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery.

Recommendations For Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V versions 16 and prior, update to a version later than 16. For Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. 24061 and prior, update to a version later than the first 5 digits of serial No. 24061. For Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. 24061 and prior, update to a version later than the first 5 digits of serial No. 24061. For Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number 24051 and prior, update to a version later than the first 5 digits of serial number 24051. For Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number 24051 and prior, update to a version later than the first 5 digits of serial number 24051. For Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, update to a fixed version. For Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, update to a fixed version. For Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, update to a fixed version. For Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number 24051 and prior, update to a version later than the first 5 digits of serial number 24051. For Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number 24051 and prior, update to a version later than the first 5 digits of serial number 24051. For Mitsubishi Electric MELIPC Series MI5122-VW versions 05 and prior, update to a version later than 05.

Fix

Improper Locking

Weakness Enumeration

CWE-667

CWE-413

Related Identifiers

CVE-2022-24946

Affected Products

Melipc Series Mi5122-Vw

Melsec Iq-R Series R12Ccpu-V

Melsec L Series L02/06/26Cpu

Melsec L Series L26Cpu-(P)Bt

Melsec Q Series Q03/04/06/13/26Udvcpu

Melsec Q Series Q03Udecpu

Melsec Q Series Q04/06/10/13/20/26/50/100Udehcpu

Melsec Q Series Q04/06/13/26Udpvcpu

Melsec Q Series Q12Dccpu-V

Melsec Q Series Q24/26Dhccpu-Ls

Melsec Q Series Q24Dhccpu-V

References · 6

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24946 · Security Note
• https://t.me/cvenotify/32296 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-172-01 · Note
• https://t.me/cvenotify/31932 · Telegram Post
• https://jvn.jp/vu/JVNVU90895626/index.html · Note