CVE-2022-33318

Vulnerability

A deserialization of untrusted data vulnerability (CWE-502) exists in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, including the Iconics Digital Solutions variant, ICONICS Suite versions 10.97 to 10.97.1, including the Iconics Digital Solutions variant, GENESIS32 versions 9.7 and prior, and MC Works64 versions 4.04E and prior [1][2]. The affected components perform deserialization of input without proper validation, allowing an attacker to inject malicious serialized objects.

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending specially crafted packets to the server [1]. No user interaction or special network position beyond network access to the server is required. The attacker crafts malicious serialized data that, when deserialized by the server, triggers the execution of arbitrary code.

Impact

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary malicious code on the server [1]. This results in full compromise of the confidentiality, integrity, and availability of the affected system, potentially allowing the attacker to take complete control of the server.

Mitigation

Mitsubishi Electric has released updates to address this vulnerability. Users should update GENESIS64 and ICONICS Suite to version 10.97.2 or later, GENESIS32 to version 9.8 or later, and MC Works64 to version 4.05 or later [1]. No workarounds are provided in the available references. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.