CVE-2022-40267 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Medium 5.9 Published 20 Jan 2023 Updated 3 Aug 2024

Remote attackers can bypass authentication on Mitsubishi MELSEC PLC web servers by predicting weak random numbers, gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-40267?

CVE-2022-40267 is a medium-severity authentication bypass vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Seres FX5U-80MT/ES, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numbers.

Weakness: CWE-335, CWE-337

Which versions are affected by CVE-2022-40267?

It affects 53 products.

Products include Mitsubishielectric Fx5s-30mr\/Es Firmware, Mitsubishielectric Fx5s-30mt\/Es Firmware, Mitsubishielectric Fx5s-30mt\/Ess Firmware, Mitsubishielectric Fx5s-40mr\/Es Firmware, Mitsubishielectric Fx5s-40mt\/Es Firmware, Mitsubishielectric Fx5s-40mt\/Ess Firmware and 47 more.

How do I fix CVE-2022-40267?

No fix has been published for CVE-2022-40267 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-40267 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40267 exists.

CVE-2023-4625 Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module Medium 5.3

Sources

Also known as GHSA-9vv4-3cf7-mqqr.