CVE-2022-402675.9MediumCWE-337

CVE-2022-40267: Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ES

Affected: Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.2%probability of exploitation in the next 30 days

69th percentile

050100

Higher than 69% of scored CVEs

5.9MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numbers.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Seres FX5U-80MT/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/ESserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/DSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ESSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ESSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/ESSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DSSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DSSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DSSserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/Dserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-64MT/Dserial number 17X**** or later, and versions 1.280 and prior; serial number 179**** and prior, and versions 1.074 and pri…

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Predictable Seed in Pseudo-Random Number Generator (PRNG) · Cryptography
Vendor: Mitsubishi Electric Corporation
Published: January 2023
Band: Possible (1 to 10%), January 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2022-40267 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.