Vulnerability-Lookup

ICSA-22-202-04

Vulnerability from csaf_cisa - Published: 2022-07-26 06:00 - Updated: 2026-01-15 07:00

Summary

ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update B)

Notes

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Risk evaluation

Successful exploitation of these vulnerabilities could result in information disclosure, remote code execution, or a denial-of-service condition.

Critical infrastructure sectors

Critical Manufacturing

Countries/areas deployed

Worldwide

Company headquarters location

United States, Japan

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Recommended Practices

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Recommended Practices

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Recommended Practices

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Recommended Practices

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

Recommended Practices

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Steven Seeley",
          "Alex Birmberg",
          "Ben McBride",
          "Axel \u00270vercl0k\u0027",
          "Souchet"
        ],
        "organization": "Trend Micro Zero Day Initiative",
        "summary": "reported these vulnerabilities to CISA"
      },
      {
        "names": [
          "Chris Anastasio",
          "Noam Moshe"
        ],
        "organization": "Claroty Research",
        "summary": "reported these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in information disclosure, remote code execution, or a denial-of-service condition.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States, Japan",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-202-04 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-202-04.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-22-202-04 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks"
      }
    ],
    "title": "ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update B)",
    "tracking": {
      "current_release_date": "2026-01-15T07:00:00.000000Z",
      "generator": {
        "date": "2026-01-14T22:05:04.854174Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-202-04",
      "initial_release_date": "2022-07-26T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-07-26T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Republication of Mitsubishi Electric Advisory."
        },
        {
          "date": "2025-07-24T06:00:00.000000Z",
          "legacy_version": "Update A",
          "number": "2",
          "summary": "Update A - Updates to affected vendors, products and versions, CVE score, and mitigations."
        },
        {
          "date": "2026-01-15T07:00:00.000000Z",
          "legacy_version": "Update B",
          "number": "3",
          "summary": "Update B - Updates to affected products and mitigations."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=10.97|\u003c10.97.1",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric GENESIS64: \u003e=10.97|\u003c10.97.1",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=10.97|\u003c10.97.1",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric ICONICS Suite: \u003e=10.97|\u003c10.97.1",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=4.04E_excluding",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric MC Works64: \u003c=4.04E_excluding",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.7",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric GENESIS32: \u003c=9.7",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric Iconics Digital Solutions Inc., Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-29834",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ICONICS MobileHMI and IoTWorX IoT Visualizer products are affected by a path traversal vulnerability. If exploited, then this could allow traversing of the file system and access to files or directories that are outside the restricted directory on the MobileHMI server or the IoTWorX IoT Visualizer server. This traversal could then result in information disclosure.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-29834"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33315",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33315"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33316",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33316"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33317",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GraphWorX64 scripting, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, is based on JScript and .NET. It stores script code in the GraphWorX64 project files. These project files could be directly edited that could result in code execution if exploited.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33317"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33318",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains a deserialization vulnerability that could result in remote code execution if exploited.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33318"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS32 users, there are no plans to release a security update. Version 9 products are in the Retired Stage of the Product Lifecycle Policy. As described in the policy, these versions are no longer monitored for security vulnerabilities, nor are they being fixed or patched. Please see the Product Lifecycle Policy for full details.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33319",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains an out-of-bounds read issue which could result in information disclosure or a denial-of-service condition if exploited.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33319"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS32 users, there are no plans to release a security update. Version 9 products are in the Retired Stage of the Product Lifecycle Policy. As described in the policy, these versions are no longer monitored for security vulnerabilities, nor are they being fixed or patched. Please see the Product Lifecycle Policy for full details.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-33320",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "All ICONICS Suite and Mitsubishi Electric MC Works64 products contain a deserialization vulnerability that could enable malicious project configuration files to execute arbitrary code via XML code on the files.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-33320"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the Current Development version of Mitsubishi Electric Iconics Digital Solutions products as defined in Product Lifecycle Policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note, upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Please consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For GENESIS64 and ICONICS Suite users, please update your software by using the GENESIS64 and ICONICS Suite security update. The following are instructions for downloading the security update.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The security update for GENESIS64 and ICONICS Suite can be downloaded from the ICONICS Community Portal (https://iconicsinc.my.site.com/community), a web site operated by ICONICS. To download it, you need to create an account on this site and then enter a Support WorX Plan Number described in \"SupportWorX License Information\", which is shipped with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97.1 \"10.97.1 Critical Fixes Rollup 3\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003WwejAAC/10971-critical-fixes-rollup-3"
        },
        {
          "category": "vendor_fix",
          "details": "For Users using GENESIS64 and ICONICS Suite Version 10.97 \"10.97 Critical Fixes Rollup 4\" (https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4)",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://iconicsinc.my.site.com/community/s/software-update/a355a000003O4zLAAS/1097-critical-fixes-rollup-4"
        },
        {
          "category": "vendor_fix",
          "details": "For MC Works64 users, there are no plans to release a security update. To minimize the risk of exploitation of these vulnerabilities, please consider replacing to GENESIS64 or ICONICS Suite. For information on how to replace, please refer to the document below:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Replacing from MC Works64 to GENESIS64 \"GENESIS64 - How to replace MC Works64 with GENESIS64\" (Japanese Only) (https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommends that users take the following mitigations to minimize the risk of exploiting these vulnerabilities if the above countermeasures (applying security updates) cannot be implemented.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click on web links in e-mails from unreliable sources. Also, do not open attachments to untrusted emails.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Additional information and useful links are found on the ICONICS GENESIS64 security updates page.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://iconics.com/en-us/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Additional information and useful links are found on Mitsubishi Electric\u0027s security advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}

CVE-2022-33317 (GCVE-0-2022-33317)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:53 – Updated: 2026-01-09 05:09

Summary

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:21.143Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes."
            }
          ],
          "value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T05:09:15.556Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33317",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Inclusion of Functionality from Untrusted Control Sphere"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33317",
    "datePublished": "2022-07-20T16:53:59",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T05:09:15.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-29834 (GCVE-0-2022-29834)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:48 – Updated: 2026-01-09 04:54

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:33:42.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen."
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T04:54:48.324Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-29834",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97 to 10.97.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in ICONICS GENESIS64 versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and accessing the monitoring screen."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-29834",
    "datePublished": "2022-07-20T16:48:46",
    "dateReserved": "2022-04-27T00:00:00",
    "dateUpdated": "2026-01-09T04:54:48.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-33316 (GCVE-0-2022-33316)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:51 – Updated: 2026-01-09 05:07

Summary

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:21.142Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T05:07:12.066Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33316",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33316",
    "datePublished": "2022-07-20T16:51:27",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T05:07:12.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-33318 (GCVE-0-2022-33318)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:57 – Updated: 2026-01-09 05:12

Summary

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	GENESIS32	Affected: Versions 9.7 and prior
Mitsubishi Electric Iconics Digital Solutions	GENESIS32	Affected: Versions 9.7 and prior
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:21.263Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS32",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.7 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS32",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.7 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server."
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T05:12:41.871Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33318",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64 server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33318",
    "datePublished": "2022-07-20T16:57:38",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T05:12:41.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-33315 (GCVE-0-2022-33315)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:55 – Updated: 2026-01-09 04:58

Summary

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:01:20.500Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T04:58:25.913Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33315",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33315",
    "datePublished": "2022-07-20T16:55:13",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T04:58:25.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-33319 (GCVE-0-2022-33319)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:58 – Updated: 2026-01-09 05:14

Summary

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	GENESIS32	Affected: Versions 9.7 and prior
Mitsubishi Electric Iconics Digital Solutions	GENESIS32	Affected: Versions 9.7 and prior
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:21.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS32",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.7 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS32",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.7 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server."
            }
          ],
          "value": "Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T05:14:32.690Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33319",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Out-of-bounds Read vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64 server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds Read"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33319",
    "datePublished": "2022-07-20T16:58:49",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T05:14:32.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-33320 (GCVE-0-2022-33320)

Vulnerability from cvelistv5 – Published: 2022-07-20 16:56 – Updated: 2026-01-09 05:16

Summary

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Mitsubishi

References

URL

Tags

	https://www.mitsubishielectric.com/en/psirt/vulne…	vendor-advisory
	https://jvn.jp/vu/JVNVU96480474/index.html	government-resource
	https://www.cisa.gov/news-events/ics-advisories/i…	government-resource

Impacted products

Vendor

Product

Version

Mitsubishi Electric

GENESIS64

Affected: Versions 10.97 to 10.97.1

Mitsubishi Electric Iconics Digital Solutions	GENESIS64	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	Affected: Versions 10.97 to 10.97.1
Mitsubishi Electric	MC Works64	Affected: Versions 4.04E and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:21.319Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GENESIS64",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ICONICS Suite",
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97 to 10.97.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MC Works64",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 4.04E and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes."
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T05:16:27.798Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
          "ID": "CVE-2022-33320",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ICONICS GENESIS64; Mitsubishi Electric MC Works64",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "ICONICS GENESIS64 versions 10.97.1 and prior"
                          },
                          {
                            "version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf"
            },
            {
              "name": "https://jvn.jp/vu/JVNVU96480474/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/vu/JVNVU96480474/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2022-33320",
    "datePublished": "2022-07-20T16:56:24",
    "dateReserved": "2022-06-14T00:00:00",
    "dateUpdated": "2026-01-09T05:16:27.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ICSA-22-202-04

CVE-2022-33317 (GCVE-0-2022-33317)

CVE-2022-29834 (GCVE-0-2022-29834)

CVE-2022-33316 (GCVE-0-2022-33316)

CVE-2022-33318 (GCVE-0-2022-33318)

CVE-2022-33315 (GCVE-0-2022-33315)

CVE-2022-33319 (GCVE-0-2022-33319)

CVE-2022-33320 (GCVE-0-2022-33320)

Tags

Sightings

Nomenclature