CVE Intelligence
Skip to main content
MEDIUM

CVE-2022-40267

CVE-2022-40267 — Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions…

Published Updated Sources: cvelistV5, Mitsubishi

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

1%

chance of exploitation in 30 days

Affects

mitsubishi electric

120 products listed

CVSS base

5.9

MEDIUM

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

PoC

none · proof-of-concept · active

Automatable

No

can an attacker script all four kill-chain steps

Technical impact

Partial

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Products (120)

melsec iq f series fx5u 32mt esmelsec iq f series fx5u 64mt esmelsec iq f seres fx5u 80mt esmelsec iq f series fx5u 32mr esmelsec iq f series fx5u 64mr esmelsec iq f series fx5u 80mr esmelsec iq f series fx5u 32mt dsmelsec iq f series fx5u 64mt dsmelsec iq f series fx5u 80mt dsmelsec iq f series fx5u 32mr dsmelsec iq f series fx5u 64mr dsmelsec iq f series fx5u 80mr dsmelsec iq f series fx5u 32mt essmelsec iq f series fx5u 64mt essmelsec iq f series fx5u 80mt essmelsec iq f series fx5u 32mt dssmelsec iq f series fx5u 64mt dssmelsec iq f series fx5u 80mt dssmelsec iq f series fx5uc 32mt dmelsec iq f series fx5uc 64mt dmelsec iq f series fx5uc 96mt dmelsec iq f series fx5uc 32mt dssmelsec iq f series fx5uc 64mt dssmelsec iq f series fx5uc 96mt dssmelsec iq f series fx5uc 32mt ds tsmelsec iq f series fx5uc 32mt dss tsmelsec iq f series fx5uc 32mr ds tsmelsec iq r series r00cpumelsec iq r series r01cpumelsec iq r series r02cpumelsec iq r series r04cpumelsec iq r series r08cpumelsec iq r series r16cpumelsec iq r series r32cpumelsec iq r series r120cpumelsec iq r series r04encpumelsec iq r series r08encpumelsec iq r series r16encpumelsec iq r series r32encpumelsec iq r series r120encpumelsec iq f series fx5uj 24mt esmelsec iq f series fx5uj 40mt esmelsec iq f series fx5uj 60mt esmelsec iq f series fx5uj 24mr esmelsec iq f series fx5uj 40mr esmelsec iq f series fx5uj 60mr esmelsec iq f series fx5uj 24mt essmelsec iq f series fx5uj 40mt essmelsec iq f series fx5uj 60mt essmelsec iq f series fx5uj 24mt es amelsec iq f series fx5uj 40mt es amelsec iq f series fx5uj 60mt es amelsec iq f series fx5uj 24mr es amelsec iq f series fx5uj 40mr es amelsec iq f series fx5uj 60mr es amelsec iq f series fx5s 30mt esmelsec iq f series fx5s 40mt esmelsec iq f series fx5s 60mt esmelsec iq f series fx5s 80mt esmelsec iq f series fx5s 30mr esmelsec iq f series fx5s 40mr esmelsec iq f series fx5s 60mr esmelsec iq f series fx5s 80mr esmelsec iq f series fx5s 30mt essmelsec iq f series fx5s 40mt essmelsec iq f series fx5s 60mt essmelsec iq f series fx5s 80mt essfx5u 80mt ess firmwarefx5u 32mt dss firmwarefx5u 64mt dss firmwarefx5u 80mt dss firmwarefx5uc 32mt d firmwarefx5uc 64mt d firmwarefx5uc 96mt d firmwarefx5uc 32mt dss firmwarefx5uc 64mt dss firmwarefx5uc 96mt dss firmwarefx5uc 32mt ds ts firmwarefx5uc 32mt dss ts firmwarefx5uc 32mr ds ts firmwarer00cpu firmwarer01cpu firmwarer02cpu firmwarer04cpu firmwarer08cpu firmwarer16cpu firmwarer32cpu firmwarer120cpu firmwarer04encpu firmwarer08encpu firmwarer16encpu firmwarer32encpu firmwarer120encpu firmwarefx5uj 24mt es firmwarefx5uj 40mt es firmwarefx5uj 60mt es firmwarefx5uj 24mr es firmwarefx5uj 40mr es firmwarefx5uj 60mr es firmwarefx5uj 24mt ess firmwarefx5uj 40mt ess firmwarefx5uj 60mt ess firmwarefx5uj 24mt es a firmwarefx5uj 40mt es a firmwarefx5uj 60mt es a firmwarefx5uj 24mr es a firmwarefx5uj 40mr es a firmwarefx5uj 60mr es a firmwarefx5s 30mt es firmwarefx5s 40mt es firmwarefx5s 60mt es firmwarefx5s 80mt es firmwarefx5s 30mr es firmwarefx5s 40mr es firmwarefx5s 60mr es firmwarefx5s 80mr es firmwarefx5s 30mt ess firmwarefx5s 40mt ess firmwarefx5s 60mt ess firmwarefx5s 80mt ess firmware

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
5.9CVSS 3.1MEDIUM——cvelistV5

Weakness & attack patterns

  • CWE-337

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

  • Search application, proxy, and WAF logs for requests touching /z, /DS-TS, /DSS-TS.

References

4 on the record

Elsewhere on this site

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.