CVE-2022-24946
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to cause denial of service (DoS) conditions in Mitsubishi Electric PLCs and industrial controllers by sending specially crafted packets. Affected systems require a physical reset to recover. The vulnerability impacts multiple MELSEC and MELIPC series products used in industrial automation.
💻 Affected Systems
- Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V
- Mitsubishi Electric MELSEC-Q Series Q03UDECPU
- Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU
- Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU
- Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU
- Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V
- Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G)
- Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS
- Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P)
- Mitsubishi Electric MELSEC-L series L26CPU-(P)BT
- Mitsubishi Electric MELIPC Series MI5122-VW
📦 What is this software?
L02cpu Firmware by Mitsubishielectric
L02cpu P Firmware by Mitsubishielectric
L02scpu Firmware by Mitsubishielectric
L02scpu P Firmware by Mitsubishielectric
L06cpu Firmware by Mitsubishielectric
L06cpu P Firmware by Mitsubishielectric
L26cpu \(p\)bt Firmware by Mitsubishielectric
L26cpu Bt Cm Firmware by Mitsubishielectric
L26cpu Bt Firmware by Mitsubishielectric
L26cpu Firmware by Mitsubishielectric
L26cpu P Firmware by Mitsubishielectric
L26cpu Pbt Firmware by Mitsubishielectric
Q03udecpu Firmware by Mitsubishielectric
Q04udehcpu Firmware by Mitsubishielectric
Q04udpvcpu Firmware by Mitsubishielectric
Q04udvcpu Firmware by Mitsubishielectric
Q06ccpu V Firmware by Mitsubishielectric
Q06phcpu Firmware by Mitsubishielectric
Q06udehcpu Firmware by Mitsubishielectric
Q06udpvcpu Firmware by Mitsubishielectric
Q06udvcpu Firmware by Mitsubishielectric
Q100udehcpu Firmware by Mitsubishielectric
Q10udehcpu Firmware by Mitsubishielectric
Q13udehcpu Firmware by Mitsubishielectric
Q13udpvcpu Firmware by Mitsubishielectric
Q13udvcpu Firmware by Mitsubishielectric
Q20udehcpu Firmware by Mitsubishielectric
Q26dhccpu Ls Firmware by Mitsubishielectric
Q26udehcpu Firmware by Mitsubishielectric
Q26udpvcpu Firmware by Mitsubishielectric
Q26udvcpu Firmware by Mitsubishielectric
Q50udehcpu Firmware by Mitsubishielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of industrial processes requiring physical system reset, potentially causing production downtime, safety incidents, or equipment damage.
Likely Case
Temporary disruption of Ethernet communications leading to process interruptions until manual reset is performed.
If Mitigated
Limited impact if systems are isolated in segmented networks with proper access controls.
🎯 Exploit Status
Crafting malicious packets requires understanding of the protocol but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Mitsubishi Electric for specific firmware updates
Vendor Advisory: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf
Restart Required: Yes
Instructions:
1. Contact Mitsubishi Electric support for firmware updates. 2. Schedule maintenance window. 3. Backup configuration. 4. Apply firmware update. 5. Test functionality. 6. Document changes.
🔧 Temporary Workarounds
Network segmentation
allIsolate affected devices in separate VLANs with strict firewall rules
Access control lists
allImplement network ACLs to restrict communication to trusted sources only
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access
- Monitor network traffic for anomalous patterns and implement intrusion detection
🔍 How to Verify
Check if Vulnerable:
Check product model, serial number, and firmware version against vendor advisory specificationsCheck Version:
Use Mitsubishi Electric programming software or check device configurationVerify Fix Applied:
Verify firmware version has been updated beyond vulnerable versions listed in advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected device resets
- Communication timeouts
- Ethernet interface errors
Network Indicators:
- Unusual packet patterns to PLC ports
- Traffic from untrusted sources to industrial devices
SIEM Query:
Search for: (device_type:plc OR device_type:scada) AND (event_type:reset OR event_type:timeout) AND source_ip NOT IN trusted_networks🔗 References
- https://jvn.jp/vu/JVNVU90895626/index.html
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf
- https://jvn.jp/vu/JVNVU90895626/index.html
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf
