CVE-2022-25163

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets.

Una vulnerabilidad de comprobación de entrada inapropiada en Mitsubishi Electric MELSEC-Q Series QJ71E71-100 primeros 5 dígitos del número de serie "24061" o anterior, Mitsubishi Electric MELSEC-L series LJ71E71-100 primeros 5 dígitos del número de serie "24061" o anterior y Mitsubishi Electric MELSEC iQ-R Series RD81MES96N versión de firmware "08" o anterior permite a un atacante remoto no autenticado causar una condición de denegación de servicio (DoS) o ejecutar código malicioso en los productos de destino mediante el envío de paquetes especialmente diseñados

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-02-14 CVE Reserved
2022-06-02 CVE Published
2024-08-03 CVE Updated
2024-08-24 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (2)

URL	Tag	Source
https://jvn.jp/vu/JVNVU92561747/index.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-006_en.pdf	2022-06-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mitsubishi Search vendor "Mitsubishi"	Melsec Iq-r Rd81mes96n Firmware Search vendor "Mitsubishi" for product "Melsec Iq-r Rd81mes96n Firmware"	< 09 Search vendor "Mitsubishi" for product "Melsec Iq-r Rd81mes96n Firmware" and version " < 09"	-	Affected	in	Mitsubishi Search vendor "Mitsubishi"	Melsec Iq-r Rd81mes96n Search vendor "Mitsubishi" for product "Melsec Iq-r Rd81mes96n"	-	-	Safe
Mitsubishi Search vendor "Mitsubishi"	Melsec Qj71e71-100 Firmware Search vendor "Mitsubishi" for product "Melsec Qj71e71-100 Firmware"	< 24062 Search vendor "Mitsubishi" for product "Melsec Qj71e71-100 Firmware" and version " < 24062"	f	Affected	in	Mistubishi Search vendor "Mistubishi"	Melsec Qj71e71-100 Search vendor "Mistubishi" for product "Melsec Qj71e71-100"	-	-	Safe
Mitsubishi Search vendor "Mitsubishi"	Melsec Lj71e71-100 Firmware Search vendor "Mitsubishi" for product "Melsec Lj71e71-100 Firmware"	< 24062 Search vendor "Mitsubishi" for product "Melsec Lj71e71-100 Firmware" and version " < 24062"	-	Affected	in	Mitsubishi Search vendor "Mitsubishi"	Melsec Lj71e71-100 Search vendor "Mitsubishi" for product "Melsec Lj71e71-100"	-	-	Safe