CVE-2022-24946 : Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Serie

Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number "24051" and prior and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery.

Published 2022-06-15 21:15:09

Updated 2022-08-19 23:25:31

Source Mitsubishi Electric Corporation

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-24946

Mitsubishielectric » Q04udvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q04udvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q04udvcpu » Version: N/A
Mitsubishielectric » Q06udvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q06udvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q06udvcpu » Version: N/A
Mitsubishielectric » Q13udvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q13udvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q13udvcpu » Version: N/A
Mitsubishielectric » Q26udvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q26udvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q26udvcpu » Version: N/A
Mitsubishielectric » Q04udpvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q04udpvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q04udpvcpu » Version: N/A
Mitsubishielectric » Q06udpvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q06udpvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q06udpvcpu » Version: N/A
Mitsubishielectric » Q13udpvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q13udpvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q13udpvcpu » Version: N/A
Mitsubishielectric » Q26udpvcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q26udpvcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q26udpvcpu » Version: N/A
Mitsubishielectric » Q03udecpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q03udecpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q03udecpu » Version: N/A
Mitsubishielectric » Q04udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q04udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q04udehcpu » Version: N/A
Mitsubishielectric » Q06udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q06udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q06udehcpu » Version: N/A
Mitsubishielectric » Q10udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q10udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q10udehcpu » Version: N/A
Mitsubishielectric » Q13udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q13udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q13udehcpu » Version: N/A
Mitsubishielectric » Q20udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q20udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q20udehcpu » Version: N/A
Mitsubishielectric » Q26udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q26udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q26udehcpu » Version: N/A
Mitsubishielectric » Q50udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q50udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q50udehcpu » Version: N/A
Mitsubishielectric » Q100udehcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q100udehcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q100udehcpu » Version: N/A
Mitsubishielectric » L26cpu-bt Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu-bt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu-bt » Version: N/A
Mitsubishielectric » L26cpu-pbt Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu-pbt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu-pbt » Version: N/A
Mitsubishielectric » L26cpu-bt-cm Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu-bt-cm_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu-bt-cm » Version: N/A
Mitsubishielectric » Q06ccpu-v Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q06ccpu-v_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q06ccpu-v » Version: N/A
Mitsubishielectric » L26cpu-(p)bt Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu-\(p\)bt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu-(p)bt » Version: N/A
Mitsubishielectric » L02cpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l02cpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L02cpu » Version: N/A
Mitsubishielectric » L02cpu-p Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l02cpu-p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L02cpu-p » Version: N/A
Mitsubishielectric » L02scpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l02scpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L02scpu » Version: N/A
Mitsubishielectric » L02scpu-p Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l02scpu-p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L02scpu-p » Version: N/A
Mitsubishielectric » L06cpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l06cpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L06cpu » Version: N/A
Mitsubishielectric » L06cpu-p Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l06cpu-p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L06cpu-p » Version: N/A
Mitsubishielectric » L26cpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu » Version: N/A
Mitsubishielectric » L26cpu-p Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:l26cpu-p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » L26cpu-p » Version: N/A
Mitsubishielectric » Q06phcpu Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q06phcpu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q06phcpu » Version: N/A
Mitsubishielectric » Q26dhccpu-ls Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:q26dhccpu-ls_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Q26dhccpu-ls » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-24946

EPSS FAQ

0.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24946

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-24946

CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-24946

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf

Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
https://jvn.jp/vu/JVNVU90895626/index.html

JVNVU#90895626: 三菱電機製MELSEC QおよびLシリーズにおける不適切なリソースロックの脆弱性
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-24946

Products affected by CVE-2022-24946

Exploit prediction scoring system (EPSS) score for CVE-2022-24946

CVSS scores for CVE-2022-24946

CWE ids for CVE-2022-24946

References for CVE-2022-24946