CVE-2022-33316

Vulnerability

Deserialization of Untrusted Data vulnerability (CWE-502) in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, ICONICS Suite versions 10.97 to 10.97.1, and MC Works64 versions 4.04E and prior. An attacker can embed malicious XAML code in a monitoring screen file that, when loaded by a user, triggers deserialization of untrusted data leading to arbitrary code execution [1][2].

Exploitation

An unauthenticated attacker needs to convince a user to load a specially crafted monitoring screen file containing malicious XAML codes. The file could be delivered via email, network share, or other means. No authentication is required; user interaction is required [1][2].

Impact

Successful exploitation allows arbitrary code execution on the affected system. The attacker gains the ability to execute arbitrary code with the privileges of the user running the monitoring screen application, potentially leading to full compromise of the workstation and/or server [1][2].

Mitigation

As of the advisory dates (July 2022), Mitsubishi Electric has not released patches for this vulnerability. Users are advised to apply mitigations recommended in the CISA advisory, such as restricting network access, using firewalls, and implementing application whitelisting. Affected versions: GENESIS64/ICONICS Suite 10.97 to 10.97.1, MC Works64 <=4.04E [1][2].