PT-2022-21764 · Mitsubishi+1 · Mitsubishi Electric Mc Works64+1

Published 2022-07-20 · Updated 2026-01-09 · CVE-2022-33316

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS64 versions 10.97.1 and prior Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior

Description The issue allows an unauthenticated attacker to execute arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes. This is achieved through the deserialization of untrusted data.

Recommendations For ICONICS GENESIS64 versions 10.97.1 and prior, consider disabling the loading of monitoring screen files from untrusted sources until a patch is available. For Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior, restrict access to the monitoring screen feature to minimize the risk of exploitation. As a temporary workaround, avoid using the ColorPaletteEntry deserialization functionality in ICONICS GENESIS64 until a fix is provided.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-33316

ZDI-22-1040

Affected Products

Iconics Genesis64

Mitsubishi Electric Mc Works64

References · 9

• https://zerodayinitiative.com/advisories/ZDI-22-1040 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33316 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf · Vendor Advisory
• https://jvn.jp/vu/JVNVU96480474/index.html · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-202-04 · Note
• https://t.me/cveNotify/148176 · Telegram Post
• https://t.me/cibsecurity/46684 · Telegram Post
• https://t.me/cvenotify/33866 · Telegram Post