What’s Vulnerable › Vulnerabilities

CVE-2022-33324: Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-23 · updated 2026-06-17
• Weakness: CWE-404

Description

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.

Affected products

• Mitsubishi Melipc Mi5122-Vw Firmware: all versions
• Mitsubishi Melsec Iq-L L04 Hcpu Firmware: all versions
• Mitsubishi Melsec Iq-L L08 Hcpu Firmware: all versions
• Mitsubishi Melsec Iq-L L16 Hcpu Firmware: all versions
• Mitsubishi Melsec Iq-L L32 Hcpu Firmware: all versions
• Mitsubishi Melsec Iq-R R00 Cpu Firmware: before 33.0 — fixed in 33.0
• Mitsubishi Melsec Iq-R R01 Cpu Firmware: before 33.0 — fixed in 33.0
• Mitsubishi Melsec Iq-R R02 Cpu Firmware: before 33.0 — fixed in 33.0
• Mitsubishi Melsec Iq-R R04 Cpu Firmware: before 66.0 — fixed in 66.0
• Mitsubishi Melsec Iq-R R04 Sfcpu Firmware: all versions
• Mitsubishi Melsec Iq-R R08 Cpu Firmware: before 66.0 — fixed in 66.0
• Mitsubishi Melsec Iq-R R08 Sfcpu Firmware: all versions
• Mitsubishi Melsec Iq-R R120 Cpu Firmware: before 66.0 — fixed in 66.0
• Mitsubishi Melsec Iq-R R120 Sfcpu Firmware: all versions
• Mitsubishi Melsec Iq-R R12 Ccpu-V Firmware: all versions
• Mitsubishi Melsec Iq-R R16 Cpu Firmware: before 66.0 — fixed in 66.0
• Mitsubishi Melsec Iq-R R16 Sfcpu Firmware: all versions
• Mitsubishi Melsec Iq-R R32 Cpu Firmware: before 66.0 — fixed in 66.0
• Mitsubishi Melsec Iq-R R32 Sfcpu Firmware: all versions

How to fix

Upgrade to a fixed version: Mitsubishi Melsec Iq-R R00 Cpu Firmware 33.0; Mitsubishi Melsec Iq-R R01 Cpu Firmware 33.0; Mitsubishi Melsec Iq-R R02 Cpu Firmware 33.0; Mitsubishi Melsec Iq-R R04 Cpu Firmware 66.0; Mitsubishi Melsec Iq-R R08 Cpu Firmware 66.0; Mitsubishi Melsec Iq-R R120 Cpu Firmware 66.0; Mitsubishi Melsec Iq-R R16 Cpu Firmware 66.0; Mitsubishi Melsec Iq-R R32 Cpu Firmware 66.0. Check the vendor advisory for mitigations.

References

• https://jvn.jp/vu/JVNVU96883262
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-356-03
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-018_en.pdf
• https://jvn.jp/vu/JVNVU96883262
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-356-03
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-018_en.pdf

Get alerted when CVE-2022-33324 or the next vulnerability affects your stack