PT-2022-21765 · Mitsubishi+1 · Mitsubishi Electric Mc Works64+1

Published 2022-07-20 · Updated 2026-01-09 · CVE-2022-33317

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS64 versions 10.97.1 and prior Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior

Description The issue allows an unauthenticated attacker to execute arbitrary malicious code by leading a user to load a monitoring screen file that includes malicious script codes. This is achieved through the inclusion of functionality from an untrusted control sphere.

Recommendations For ICONICS GENESIS64 versions 10.97.1 and prior, consider disabling the loading of monitoring screen files from untrusted sources until a patch is available. For Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior, restrict access to the monitoring screen file feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2022-33317

ZDI-22-1039

ZDI-22-1162

Affected Products

Iconics Genesis64

Mitsubishi Electric Mc Works64

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-33317 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1039 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1162 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33317 · Vendor Advisory
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf · Vendor Advisory
• https://jvn.jp/vu/JVNVU96480474/index.html · Note
• https://t.me/cvenotify/33865 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-22-202-04 · Note
• https://t.me/cveNotify/148177 · Telegram Post
• https://t.me/cibsecurity/46697 · Telegram Post