CVE-2022-33315

2022-07-2017:15:08

CWE-502

[email protected]

web.nvd.nist.gov

cve-2022-33315

deserialization

untrusted data

iconics genesis64

mitsubishi electric mc works64

arbitrary code execution

monitoring screen file

xaml codes

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.

Affected configurations

Nvd

Node

iconicsgenesis64Match10.97

iconicsgenesis64Match10.97.1

Node

mitsubishielectricmc_works64Range≤10.95.210.01

VendorProductVersionCPE
iconicsgenesis6410.97cpe:2.3:a:iconics:genesis64:10.97:*:*:*:*:*:*:*
iconicsgenesis6410.97.1cpe:2.3:a:iconics:genesis64:10.97.1:*:*:*:*:*:*:*
mitsubishielectricmc_works64*cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
iconics	genesis64	10.97	cpe:2.3:a:iconics:genesis64:10.97:::::::*
iconics	genesis64	10.97.1	cpe:2.3:a:iconics:genesis64:10.97.1:::::::*
mitsubishielectric	mc_works64	*	cpe:2.3:a:mitsubishielectric:mc_works64::::::::