CVE-2022-33323: Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series

Published Feb 2, 2023

Updated

Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

Affected Software

106 affected components

Mitsubishi Electric Corporation MELFA SD/SQ Series: firmware version S7x and prior

Mitsubishi Electric Corporation MELFA SD/SQ Series: firmware version R7x and prior

Mitsubishi Electric Corporation MELFA F-Series: firmware version S7x and prior

Mitsubishi Electric Corporation MELFA F-Series: firmware version R7x and prior

Mitsubishielectric Rh-12sdh55 Firmware

Mitsubishielectric Rh-12sdh55

Mitsubishielectric Rh-12sdh70 Firmware

Mitsubishielectric Rh-12sdh70

Mitsubishielectric Rh-12sdh85 Firmware

Mitsubishielectric Rh-12sdh85

Mitsubishielectric Rh-12sqh55 Firmware

Mitsubishielectric Rh-12sqh55

Mitsubishielectric Rh-12sqh70 Firmware

Mitsubishielectric Rh-12sqh70

Mitsubishielectric Rh-12sqh85 Firmware

Mitsubishielectric Rh-12sqh85

Mitsubishielectric Rh-20sdh100 Firmware

Mitsubishielectric Rh-20sdh100

Mitsubishielectric Rh-20sdh85 Firmware

Mitsubishielectric Rh-20sdh85

Mitsubishielectric Rh-20sqh85 Firmware

Mitsubishielectric Rh-20sqh85

Mitsubishielectric Rh-3sdhr Firmware

Mitsubishielectric Rh-3sdhr

Mitsubishielectric Rh-3sqhr Firmware

Mitsubishielectric Rh-3sqhr

Mitsubishielectric Rh-6sdh35 Firmware

Mitsubishielectric Rh-6sdh35

Mitsubishielectric Rh-6sdh45 Firmware

Mitsubishielectric Rh-6sdh45

Mitsubishielectric Rh-6sdh55 Firmware

Mitsubishielectric Rh-6sdh55

Mitsubishielectric Rh-6sqh35 Firmware

Mitsubishielectric Rh-6sqh35

Mitsubishielectric Rh-6sqh45 Firmware

Mitsubishielectric Rh-6sqh45

Mitsubishielectric Rh-6sqh55 Firmware

Mitsubishielectric Rh-6sqh55

Mitsubishielectric Rv-12sd Firmware

Mitsubishielectric Rv-12sd

Mitsubishielectric Rv-12sdl Firmware

Mitsubishielectric Rv-12sdl

Mitsubishielectric Rv-12sq Firmware

Mitsubishielectric Rv-12sq

Mitsubishielectric Rv-12sql Firmware

Mitsubishielectric Rv-12sql

Mitsubishielectric Rv-2sdb Firmware

Mitsubishielectric Rv-2sdb

Mitsubishielectric Rv-2sqb Firmware

Mitsubishielectric Rv-2sqb

Mitsubishielectric Rv-3sd Firmware

Mitsubishielectric Rv-3sd

Mitsubishielectric Rv-3sdj Firmware

Mitsubishielectric Rv-3sdj

Mitsubishielectric Rv-3sq Firmware

Mitsubishielectric Rv-3sq

Mitsubishielectric Rv-3sqj Firmware

Mitsubishielectric Rv-3sqj

Mitsubishielectric Rv-6sd Firmware

Mitsubishielectric Rv-6sd

Mitsubishielectric Rv-6sdl Firmware

Mitsubishielectric Rv-6sdl

Mitsubishielectric Rv-6sq Firmware

Mitsubishielectric Rv-6sq

Mitsubishielectric Rv-6sql Firmware

Mitsubishielectric Rv-6sql

Mitsubishielectric Rh-12fh55 Firmware

Mitsubishielectric Rh-12fh55

Mitsubishielectric Rh-12fh70 Firmware

Mitsubishielectric Rh-12fh70

Mitsubishielectric Rh-12fh85 Firmware

Mitsubishielectric Rh-12fh85

Mitsubishielectric Rh-20fh100 Firmware

Mitsubishielectric Rh-20fh100

Mitsubishielectric Rh-20fh85 Firmware

Mitsubishielectric Rh-20fh85

Mitsubishielectric Rh-3fh35 Firmware

Mitsubishielectric Rh-3fh35

Mitsubishielectric Rh-3fh45 Firmware

Mitsubishielectric Rh-3fh45

Mitsubishielectric Rh-3fh55 Firmware

Mitsubishielectric Rh-3fh55

Mitsubishielectric Rh-6fh35 Firmware

Mitsubishielectric Rh-6fh35

Mitsubishielectric Rh-6fh45 Firmware

Mitsubishielectric Rh-6fh45

Mitsubishielectric Rh-6fh55 Firmware

Mitsubishielectric Rh-6fh55

Mitsubishielectric Rv-13f Firmware

Mitsubishielectric Rv-13f

Mitsubishielectric Rv-13fl Firmware

Mitsubishielectric Rv-13fl

Mitsubishielectric Rv-20f Firmware

Mitsubishielectric Rv-20f

Mitsubishielectric Rv-2f Firmware

Mitsubishielectric Rv-2f

Mitsubishielectric Rv-4f Firmware

Mitsubishielectric Rv-4f

Mitsubishielectric Rv-4fl Firmware

Mitsubishielectric Rv-4fl

Mitsubishielectric Rv-7f Firmware

Mitsubishielectric Rv-7f

Mitsubishielectric Rv-7fl Firmware

Mitsubishielectric Rv-7fl

Mitsubishielectric Rv-7fll Firmware

Mitsubishielectric Rv-7fll

Event History

Feb 2, 2023

CVE Published

via MITRE·05:49 AM

Data Sourced

via MITRE·05:49 AM

DescriptionSeverityWeakness

Aug 3, 2024

Data Sourced

via ICS·08:13 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-026-05

Frequently Asked Questions

What is the severity of CVE-2022-33323?

CVE-2022-33323 has been classified as a critical vulnerability due to its ability to allow unauthorized remote access.

How do I fix CVE-2022-33323?

To mitigate CVE-2022-33323, update the affected Mitsubishi Electric firmware to the latest version provided by the vendor.

Which devices are affected by CVE-2022-33323?

CVE-2022-33323 affects various models in the Mitsubishi Electric MELFA SD/SQ Series and MELFA F-Series with specific firmware versions.

Can CVE-2022-33323 be exploited remotely?

Yes, CVE-2022-33323 can be exploited remotely by an unauthenticated attacker through an unauthorized telnet login.

What impact does CVE-2022-33323 have on industrial control systems?

The impact of CVE-2022-33323 on industrial control systems includes potential unauthorized access, leading to disruption or manipulation of robotic operations.