CVE-2022-33315

Vulnerability

Deserialization of untrusted data vulnerability exists in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, ICONICS Suite versions 10.97 to 10.97.1, and MC Works64 versions 4.04E and prior [1][2]. The vulnerability occurs when a user loads a monitoring screen file containing malicious XAML codes, which are deserialized without proper validation.

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious monitoring screen file with embedded XAML payloads and convincing a user to open it in the affected software [1]. No authentication or special network access is required; the attacker only needs to deliver the file to the user (e.g., via email or download).

Impact

Successful exploitation allows the attacker to execute arbitrary code on the target system with the privileges of the user running the software [1][2]. This can lead to full compromise of the affected workstation or server, including data theft, system modification, or further lateral movement.

Mitigation

Mitsubishi Electric has released updates to address this vulnerability; users should contact the vendor for specific fixed version numbers [1][2]. As a workaround, avoid opening monitoring screen files from untrusted sources. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the advisory date.