CVE-2022-33317

Vulnerability

This vulnerability is an Inclusion of Functionality from Untrusted Control Sphere (CWE-829) affecting Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior [1][2]. The flaw allows an unauthenticated attacker to execute arbitrary malicious code by convincing a user to load a monitoring screen file that includes malicious script code from an untrusted source.

Exploitation

To exploit this vulnerability, an attacker must craft a malicious monitoring screen file that incorporates script from an untrusted control sphere. The attacker then socially engineers a user to open this file within the affected application. No authentication is required, and the attacker does not require network access beyond delivering the file to the user [1][2].

Impact

Successful exploitation results in arbitrary code execution in the context of the affected application. This can lead to full system compromise, including information disclosure, data modification, or denial of service [1][2].

Mitigation

Mitsubishi Electric has released fixes: for GENESIS64 and ICONICS Suite, update to version 10.97.2 or later; for MC Works64, update to version 4.04F or later [1][2]. Users should contact Mitsubishi Electric Iconics Digital Solutions or Mitsubishi Electric for updates. As a workaround, avoid opening monitoring screen files from untrusted sources until the patch is applied [1][2].