CVE-2022-33323
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-489
- Affected
- mitsubishielectric/rh-12sdh55 firmware · mitsubishielectric/rh-12sdh70 firmware · mitsubishielectric/rh-12sdh85 firmware · mitsubishielectric/rh-12sqh55 firmware · mitsubishielectric/rh-12sqh70 firmware · mitsubishielectric/rh-12sqh85 firmware · mitsubishielectric/rh-20sdh100 firmware · mitsubishielectric/rh-20sdh85 firmware · mitsubishielectric/rh-20sqh85 firmware · mitsubishielectric/rh-3sdhr firmware · mitsubishielectric/rh-3sqhr firmware · mitsubishielectric/rh-6sdh35 firmware · mitsubishielectric/rh-6sdh45 firmware · mitsubishielectric/rh-6sdh55 firmware · mitsubishielectric/rh-6sqh35 firmware · mitsubishielectric/rh-6sqh45 firmware · mitsubishielectric/rh-6sqh55 firmware · mitsubishielectric/rv-12sd firmware · mitsubishielectric/rv-12sdl firmware · mitsubishielectric/rv-12sq firmware · +31 more
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://jvn.jp/vu/JVNVU94588481/index.htmlThird Party Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-05Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdfVendor Advisory
- https://jvn.jp/vu/JVNVU94588481/index.htmlThird Party Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-05Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.