CVE-2022-33324

Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series

HIGH
7.5
CVSS Score
Published: December 23, 2022 at 02:24 AM UTC
Updated: June 17, 2026 at 04:49 AM UTC
46 products affected across 1 vendorMELSEC Iq R R04 CPU FirmwareMELSEC Iq R R120 CPU FirmwareMELSEC Iq R R08 CPU Firmware· also runs on 19 platforms

Using MELSEC iQ-R Series R00CPU by Mitsubishi Electric Corporation?

Get instant alerts when new vulnerabilities affect MELSEC iQ-R Series R00CPU - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 2%

Description

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

All versions
mitsubishi-melsec-iq-l-l04-hcpu (environment)
All versions
mitsubishi-melsec-iq-l-l08-hcpu (environment)
All versions
mitsubishi-melsec-iq-l-l16-hcpu (environment)
All versions
mitsubishi-melsec-iq-l-l32-hcpu (environment)
v < 33.0
Affected range stops below 33.0, so it looks safe — our inference, not a vendor statement
mitsubishi-melsec-iq-r-r00-cpu (environment)
v < 33.0
Affected range stops below 33.0, so it looks safe — our inference, not a vendor statement
mitsubishi-melsec-iq-r-r01-cpu (environment)
v < 33.0
Affected range stops below 33.0, so it looks safe — our inference, not a vendor statement
mitsubishi-melsec-iq-r-r02-cpu (environment)
v < 66.0
Affected range stops below 66.0, so it looks safe — our inference, not a vendor statement
mitsubishi-melsec-iq-r-r04-cpu (environment)
All versions
mitsubishi-melsec-iq-r-r04-sfcpu (environment)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

7.5HIGHMitsubishi
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-404

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card