CVE-2022-33324 Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series
Remote unauthenticated attackers can cause a denial of service in Ethernet communication on Mitsubishi PLCs by sending crafted packets, requiring a system reset to recover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33324?
CVE-2022-33324 is a high-severity denial of service vulnerability in Mitsubishi Electric Corporation MELIPC Series MI5122-VW, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.
Weakness: CWE-404
Which versions are affected by CVE-2022-33324?
It affects 19 products.
Products include Mitsubishi Melipc Mi5122-Vw Firmware, Mitsubishi Melsec Iq-L L04 Hcpu Firmware, Mitsubishi Melsec Iq-L L08 Hcpu Firmware, Mitsubishi Melsec Iq-L L16 Hcpu Firmware, Mitsubishi Melsec Iq-L L32 Hcpu Firmware, Mitsubishi Melsec Iq-R R00 Cpu Firmware and 13 more.
How do I fix CVE-2022-33324?
No fix has been published for CVE-2022-33324 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33324 being exploited?
There is no known exploitation of CVE-2022-33324 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation MELIPC Series MI5122-VW
Sources
Also known as GHSA-2j9m-jh56-7553.