CVE-2022-33318: Mitsubishi Electric GENESIS64 and MC Works64 deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction on SCADA/HMI servers makes this a critical pre-auth remote code execution risk.

What it is

GENESIS64, ICONICS Suite, GENESIS32 and MC Works64 contain a deserialization of untrusted data flaw (CWE-502). A remote attacker can send specially crafted packets to the server and execute arbitrary code without authenticating. Because these are HMI/SCADA products, successful exploitation can compromise industrial control environments.

Impact

An unauthenticated remote attacker gains arbitrary code execution on the affected server, typically with the privileges of the service, allowing full control of the host and potential lateral movement into the control network.

Attack surface

The flaw is reachable over the network via crafted packets sent to the GENESIS64, ICONICS Suite, GENESIS32 or MC Works64 server. The CVSS vector shows no privileges required and no user interaction, so it is unauthenticated and remotely triggerable.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.48137, 98.8th percentile), indicating elevated likelihood of exploitation, but the references are only vendor and advisory links with no public exploit tag.

What to do

• Apply the vendor fixes referenced in the Mitsubishi Electric PSIRT advisory and CISA ICS advisory ICSA-22-202-04.
• If patching cannot be done immediately, isolate affected GENESIS64, ICONICS Suite, GENESIS32 and MC Works64 servers behind strict network segmentation and firewall rules.
• Restrict network access to the affected server ports to trusted engineering and control hosts only; do not expose these systems to untrusted networks.
• Monitor vendor advisories for updated fixed versions and confirm the exact affected build before and after remediation.
• Where feasible, run the affected services under least-privilege accounts to limit the impact of code execution.

Detection

• Monitor network traffic to GENESIS64/ICONICS/MC Works64 servers for anomalous or unexpected packet patterns and connections from non-engineering hosts.
• Alert on unexpected child processes spawned by the affected server services, especially command shells or scripting interpreters.
• Review server and application logs for crashes, deserialization errors or unusual service restarts around suspicious network activity.
• Baseline normal client-server communication and alert on new remote sources contacting the affected services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.