VIR Vulnerability Intelligence Relay

CVE-2022-24946

high
Published 2022-06-15 · Modified 2026-06-02
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.5

Description

Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number "24051" and prior and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery.

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
mitsubishielectricq03udecpu-
mitsubishielectricq04udehcpu-
mitsubishielectricq04udpvcpu-
mitsubishielectricq04udvcpu-
mitsubishielectricq100udehcpu-
mitsubishielectricq50udehcpu-
mitsubishielectricq26dhccpu-ls-
mitsubishielectricq26udehcpu-
mitsubishielectricq26udpvcpu-
mitsubishielectricq26udvcpu-
mitsubishielectricq20udehcpu-
mitsubishielectricq13udehcpu-
mitsubishielectricq13udpvcpu-
mitsubishielectricq13udvcpu-
mitsubishielectricq10udehcpu-
mitsubishielectricq06ccpu-v-
mitsubishielectricq06phcpu-
mitsubishielectricq06udehcpu-
mitsubishielectricq06udpvcpu-
mitsubishielectricq06udvcpu-
mitsubishielectricl02cpu-
mitsubishielectricl02cpu-p-
mitsubishielectricl02scpu-
mitsubishielectricl02scpu-p-
mitsubishielectricl06cpu-
mitsubishielectricl06cpu-p-
mitsubishielectricl26cpu-
mitsubishielectricl26cpu-\(p\)bt-
mitsubishielectricl26cpu-bt-
mitsubishielectricl26cpu-bt-cm-
mitsubishielectricl26cpu-p-
mitsubishielectricl26cpu-pbt-

References

CWEs

CWE-667 CWE-413

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.