PT-2022-21771 · Mitsubishi · Melsec Iq-R Series R12Ccpu-V+5

Published 2022-12-23 · Updated 2024-09-05 · CVE-2022-33324

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions 32 and prior Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions 65 and prior Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions 29 and prior Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions 08 and prior Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions 17 and prior Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions 05 and prior Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions 07 and prior

Description The issue allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.

Recommendations For Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions 32 and prior, update to a version later than 32. For Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions 65 and prior, update to a version later than 65. For Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions 29 and prior, update to a version later than 29. For Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions 08 and prior, update to a version later than 08. For Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions 17 and prior, update to a version later than 17. For Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions 05 and prior, update to a version later than 05. For Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions 07 and prior, update to a version later than 07.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2022-33324

Affected Products

Melipc Series Mi5122-Vw

Melsec Iq-L Series L04/08/16/32Hcpu

Melsec Iq-R Series R00/01/02Cpu

Melsec Iq-R Series R04/08/16/32/120(En)Cpu

Melsec Iq-R Series R08/16/32/120Psfcpu

Melsec Iq-R Series R12Ccpu-V

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-33324 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33324 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-356-03 · Patch
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-018_en.pdf · Vendor Advisory
• https://t.me/cibsecurity/55227 · Telegram Post
• https://t.me/cvenotify/81501 · Telegram Post
• https://t.me/cvenotify/40479 · Telegram Post
• https://t.me/cvenotify/63400 · Telegram Post
• https://t.me/cvenotify/54364 · Telegram Post
• https://t.me/cvenotify/93278 · Telegram Post
• https://jvn.jp/vu/JVNVU96883262 · Note