Skip to content
Fencer Vulns
high 7.5

CVE-2022-33324 json

Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series

published 2022-12-23 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-36367

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.

Patch / fix

  • mitsubishi melsec_iq-r_r00_cpu_firmware 33.0
  • mitsubishi melsec_iq-r_r01_cpu_firmware 33.0
  • mitsubishi melsec_iq-r_r02_cpu_firmware 33.0
  • mitsubishi melsec_iq-r_r04_cpu_firmware 66.0
  • mitsubishi melsec_iq-r_r08_cpu_firmware 66.0
  • mitsubishi melsec_iq-r_r16_cpu_firmware 66.0
  • mitsubishi melsec_iq-r_r32_cpu_firmware 66.0
  • mitsubishi melsec_iq-r_r120_cpu_firmware 66.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-356-03 updated cvss 7.5

Mitsubishi Electric MELSEC iQ-R, iQ-L Series and MELIPC Series (Update E)

  • Mitsubishi Electric MELIPC Series MI5122-VW <=firmware_07
    affected: vendor fix, mitigation “Mitsubishi Electric fixed the following products:” mitsubishielectric.com
  • Mitsubishi Electric MELSEC iQ-L Series L04HCPU (sold in limited regions) <=firmware_05 Mitsubishi Electric MELSEC iQ-L Series L08HCPU (sold in limited regions) <=firmware_05 Mitsubishi Electric MELSEC iQ-L Series L16HCPU (sold in limited regions) <=firmware_05 Mitsubishi Electric MELSEC iQ-L Series L32HCPU (sold in limited regions) <=firmware_05
    affected: mitigation “Mitsubishi Electric fixed the following products:” mitsubishielectric.com
  • Mitsubishi Electric MELSEC iQ-R Series R00CPU <=firmware_32 Mitsubishi Electric MELSEC iQ-R Series R01CPU <=firmware_32 Mitsubishi Electric MELSEC iQ-R Series R02CPU <=firmware_32 Mitsubishi Electric MELSEC iQ-R Series R04(EN)CPU <=firmware_65 Mitsubishi Electric MELSEC iQ-R Series R08(EN)CPU <=firmware_65 Mitsubishi Electric MELSEC iQ-R Series R08PSFCPU <=firmware_08
    +11 more products
    Mitsubishi Electric MELSEC iQ-R Series R08SFCPU <=firmware_29 Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V <=firmware_17 Mitsubishi Electric MELSEC iQ-R Series R16(EN)CPU <=firmware_65 Mitsubishi Electric MELSEC iQ-R Series R16PSFCPU <=firmware_08 Mitsubishi Electric MELSEC iQ-R Series R16SFCPU <=firmware_29 Mitsubishi Electric MELSEC iQ-R Series R32(EN)CPU <=firmware_65 Mitsubishi Electric MELSEC iQ-R Series R32PSFCPU <=firmware_08 Mitsubishi Electric MELSEC iQ-R Series R32SFCPU <=firmware_29 Mitsubishi Electric MELSEC iQ-R Series R120(EN)CPU <=firmware_65 Mitsubishi Electric MELSEC iQ-R Series R120PSFCPU <=firmware_08 Mitsubishi Electric MELSEC iQ-R Series R120SFCPU <=firmware_29
    affected: vendor fix, mitigation “Mitsubishi Electric fixed the following products:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Mitsubishi Electric Corporation MELSEC iQ-R Series R00CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R01CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R02CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R04CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R04ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V
  • Mitsubishi Electric Corporation MELSEC iQ-L Series L04HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L Series L08HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L Series L16HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L Series L32HCPU
  • Mitsubishi Electric Corporation MELIPC Series MI5122-VW
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R08PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R16PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R32PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Series R120PSFCPU

Classification

Weakness
  • CWE-404 Improper Resource Shutdown or Release

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.