CVE-2022-25163
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to send specially crafted packets to Mitsubishi Electric PLCs, potentially causing denial of service or executing arbitrary code. Affected systems include specific MELSEC-Q, MELSEC-L, and MELSEC iQ-R series modules with vulnerable firmware versions or serial numbers.
💻 Affected Systems
- Mitsubishi Electric MELSEC-Q Series QJ71E71-100
- Mitsubishi Electric MELSEC-L series LJ71E71-100
- Mitsubishi Electric MELSEC iQ-R Series RD81MES96N
📦 What is this software?
Melsec Iq R Rd81mes96n Firmware by Mitsubishi
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, manipulation of industrial processes, or permanent device damage.
Likely Case
Denial of service causing PLCs to crash or become unresponsive, disrupting industrial operations.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and packet filtering.
🎯 Exploit Status
Exploitation requires sending specially crafted packets but no authentication; complexity is low due to unauthenticated nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates available from Mitsubishi Electric; specific version varies by product
Vendor Advisory: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-006_en.pdf
Restart Required: Yes
Instructions:
1. Download firmware update from Mitsubishi Electric support site. 2. Apply update following vendor instructions. 3. Restart affected PLC modules. 4. Verify firmware version post-update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PLCs on separate network segments with strict firewall rules.
Access Control Lists
allImplement ACLs to restrict network access to PLCs only from authorized IP addresses.
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to block all unnecessary traffic to PLCs.
- Monitor network traffic for anomalous packets and implement intrusion detection systems.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via Mitsubishi Electric programming software (e.g., GX Works) or serial number on device label.Check Version:
Use Mitsubishi Electric configuration software to read firmware version from PLC.Verify Fix Applied:
Verify firmware version is updated beyond vulnerable versions using vendor tools.📡 Detection & Monitoring
Log Indicators:
- PLC crash logs, abnormal restart events, or communication errors in industrial control system logs
Network Indicators:
- Unusual packets to PLC ports (typically TCP/UDP ports used by MELSEC protocols), spikes in network traffic to PLCs
SIEM Query:
source="plc_logs" AND (event_type="crash" OR event_type="restart") OR dest_ip="PLC_IP" AND packet_size>threshold