CVE-2022-25163 Other in Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N
Remote unauthenticated attackers can cause denial of service or execute malicious code on Mitsubishi Electric PLC modules via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25163?
CVE-2022-25163 is a critical vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N, published on 2 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets.
Weakness: CWE-20
Which versions are affected by CVE-2022-25163?
It affects 3 products.
Products include Mitsubishi Melsec Iq-R Rd81mes96n Firmware, Mitsubishi Melsec Lj71e71-100 Firmware, Mitsubishi Melsec Qj71e71-100 Firmware.
How do I fix CVE-2022-25163?
No fix has been published for CVE-2022-25163 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25163 being exploited?
There is no known exploitation of CVE-2022-25163 in the wild and no public exploit code.
Sources
Also known as GHSA-p5m3-f8vg-7g3w.