← Vulnerability feed

Vulnerability record · CVE-2022-33319 · published 20 July 2022

CVE-2022-33319: Iconics genesis64 out-of-bounds read vulnerability

Iconics · Genesis64

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

9.1 CVSS 3.1 Critical EPSS 1.6% · top 24.8% CWE-125 · Out-of-bounds read
9.1CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU96480474/index.html Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf Third Party Advisory
https://jvn.jp/vu/JVNVU96480474/index.html Third Party Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf Third Party Advisory

Track CVE-2022-33319 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-6943Mitsubishielectric ezsocket vulnerabilityUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions…EPSS 2.1%9.8CVE-2022-33318Mitsubishi Electric GENESIS64 and MC Works64 deserialization RCEGENESIS64, ICONICS Suite, GENESIS32 and MC Works64 contain a deserialization of untrusted data flaw (CWE-502). A remote attacker can send specially c…EPSS 48%analysed9.8CVE-2022-23128Iconics analytix vulnerabilityIncomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS G…EPSS 2.9%9.8CVE-2020-12007Mitsubishielectric mc works deserialization of untrusted data vulnerabilityA specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a de…EPSS 3.9%9.8CVE-2020-12011Mitsubishielectric mc works out-of-bounds write vulnerabilityA specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This …EPSS 29%9.1CVE-2020-12013Mitsubishielectric mc works32 code injection vulnerabilityA specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi El…EPSS 3.0%7.8CVE-2024-7587Iconics genesis64 incorrect default permissions vulnerabilityIncorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 an…EPSS 0.19%7.8CVE-2022-33315Iconics genesis64 deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solut…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2022-33319), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.