CVE-2022-33320

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
MitsubishiCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
iconicsgenesis64
10.97
iconicsgenesis64
10.97.1
mitsubishielectricmc_works64
𝑥
≤ 10.95.210.01
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jvn.jp/vu/JVNVU96480474/index.html
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
https://jvn.jp/vu/JVNVU96480474/index.html
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf