CVE-2022-33320

Katalog CVE

CVSS 7.8 · High EPSS 0,46%

Kerentanan Deserialization of Untrusted Data pada iconics genesis64, mitsubishielectric mc works64. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.

Rincian

Terbit di NVD

20 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jvn.jp/vu/JVNVU96480474/index.html advisory pihak ketiga
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf advisory pihak ketiga
• https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04