CVE-2022-33315
ICONICS GENESIS64 GraphWorX64 TDFX File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
Una vulnerabilidad de Deserialización de Datos No Confiables en ICONICS GENESIS64 versiones 10.97.1 y anteriores y Mitsubishi Electric MC Works64 versiones 4.04E (10.95.210.01) y anteriores permite a un atacante no autenticado ejecutar un código malicioso arbitrario al conllevar a un usuario a cargar un archivo de pantalla de monitoreo que incluye códigos XAML maliciosos
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS GENESIS64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of TDFX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-06-14 CVE Reserved
- 2022-07-20 CVE Published
- 2024-08-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://jvn.jp/vu/JVNVU96480474/index.html | Third Party Advisory | |
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Iconics Search vendor "Iconics" | Genesis64 Search vendor "Iconics" for product "Genesis64" | 10.97 Search vendor "Iconics" for product "Genesis64" and version "10.97" | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Genesis64 Search vendor "Iconics" for product "Genesis64" | 10.97.1 Search vendor "Iconics" for product "Genesis64" and version "10.97.1" | - |
Affected
| ||||||
| Mitsubishielectric Search vendor "Mitsubishielectric" | Mc Works64 Search vendor "Mitsubishielectric" for product "Mc Works64" | <= 10.95.210.01 Search vendor "Mitsubishielectric" for product "Mc Works64" and version " <= 10.95.210.01" | - |
Affected
| ||||||