← Vulnerability feed

Vulnerability record · CVE-2022-33315 · published 20 July 2022

CVE-2022-33315: Iconics genesis64 deserialization of untrusted data vulnerability

Iconics · Genesis64

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

7.8 CVSS 3.1 High EPSS 0.33% · top 76.1% CWE-502 · Deserialization of untrusted data
7.8CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU96480474/index.html Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf Third Party Advisory
https://jvn.jp/vu/JVNVU96480474/index.html Third Party Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf Third Party Advisory

Track CVE-2022-33315 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-6943Mitsubishielectric ezsocket vulnerabilityUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions…EPSS 2.1%9.8CVE-2022-33318Mitsubishi Electric GENESIS64 and MC Works64 deserialization RCEGENESIS64, ICONICS Suite, GENESIS32 and MC Works64 contain a deserialization of untrusted data flaw (CWE-502). A remote attacker can send specially c…EPSS 48%analysed9.8CVE-2022-23128Iconics analytix vulnerabilityIncomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS G…EPSS 2.9%9.8CVE-2020-12007Mitsubishielectric mc works deserialization of untrusted data vulnerabilityA specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a de…EPSS 3.9%9.8CVE-2020-12011Mitsubishielectric mc works out-of-bounds write vulnerabilityA specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This …EPSS 29%9.1CVE-2022-33319Iconics genesis64 out-of-bounds read vulnerabilityOut-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 …EPSS 1.6%9.1CVE-2020-12013Mitsubishielectric mc works32 code injection vulnerabilityA specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi El…EPSS 3.0%7.8CVE-2024-7587Iconics genesis64 incorrect default permissions vulnerabilityIncorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 an…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2022-33315), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.