Vulnerability · Published Jun 2, 2022 · Assigned by Mitsubishi

CVE-2022-25163

Critical 9.8

In plain English

A critical-severity security flaw in Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets.

Affected products (as reported)

Vendor	Product	Versions
n/a	Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N	Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or priorMitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or priorMitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-006_en.pdf x_refsource_MISC
https://jvn.jp/vu/JVNVU92561747/index.html x_refsource_MISC