CVE-2022-33323

high-risk
Published 2023-02-02

Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

Do I need to act?

~
1.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Rh-12Sdh55 Firmware
Rh-12Sdh70 Firmware
Rh-12Sdh85 Firmware
Rh-12Sqh55 Firmware
Rh-12Sqh70 Firmware
Rh-12Sqh85 Firmware
Rh-20Sdh100 Firmware
Rh-20Sdh85 Firmware
Rh-20Sqh85 Firmware
Rh-3Sdhr Firmware
Rh-3Sqhr Firmware
Rh-6Sdh35 Firmware
Rh-6Sdh45 Firmware
Rh-6Sdh55 Firmware
Rh-6Sqh35 Firmware
Rh-6Sqh45 Firmware
Rh-6Sqh55 Firmware
Rv-12Sd Firmware
Rv-12Sdl Firmware
Rv-12Sq Firmware

Affected Vendors

Mitsubishielectric

References (6)

Third Party Advisory https://jvn.jp/vu/JVNVU94588481/index.html
Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-05
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdf
Third Party Advisory https://jvn.jp/vu/JVNVU94588481/index.html
Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-05
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdf
55
/ 100
high-risk
Severity 26/34 · High
Exploitability 3/34 · Minimal
Exposure 26/34 · High