CVE-2022-40267

Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

State: Published
Severity: 5.9 Medium
Published: Jan 20, 2023
Updated: Aug 3, 2024
Reserved: Sep 8, 2022

Description

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numbers.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	Mitsubishi

Weaknesses

CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
MELSEC iQ-F Series FX5U-32MT/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MT/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Seres FX5U-80MT/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-32MR/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MR/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-80MR/ESMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-32MT/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MT/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-80MT/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-32MR/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MR/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-80MR/DSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-32MT/ESSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MT/ESSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-80MT/ESSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-32MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-64MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5U-80MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-32MT/DMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-64MT/DMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-96MT/DMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-32MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-64MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-96MT/DSSMitsubishi Electric Corporation	serial number 17X** or later, and versions 1.280 and priorAffected serial number 179** and prior, and versions 1.074 and priorAffected
MELSEC iQ-F Series FX5UC-32MT/DS-TSMitsubishi Electric Corporation	versions 1.280 and priorAffected
MELSEC iQ-F Series FX5UC-32MT/DSS-TSMitsubishi Electric Corporation	versions 1.280 and priorAffected
MELSEC iQ-F Series FX5UC-32MR/DS-TSMitsubishi Electric Corporation	versions 1.280 and priorAffected
MELSEC iQ-R Series R00CPUMitsubishi Electric Corporation	versions 33 and priorAffected
MELSEC iQ-R Series R01CPUMitsubishi Electric Corporation	versions 33 and priorAffected
MELSEC iQ-R Series R02CPUMitsubishi Electric Corporation	versions 33 and priorAffected
MELSEC iQ-R Series R04CPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R08CPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R16CPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R32CPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R120CPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R04ENCPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R08ENCPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R16ENCPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R32ENCPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-R Series R120ENCPUMitsubishi Electric Corporation	versions 66 and priorAffected
MELSEC iQ-F Series FX5UJ-24MT/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-40MT/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-60MT/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-24MR/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-40MR/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-60MR/ESMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-24MT/ESSMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-40MT/ESSMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-60MT/ESSMitsubishi Electric Corporation	1.042 and priorAffected
MELSEC iQ-F Series FX5UJ-24MT/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5UJ-40MT/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5UJ-60MT/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5UJ-24MR/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5UJ-40MR/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5UJ-60MR/ES-AMitsubishi Electric Corporation	1.043 and priorAffected
MELSEC iQ-F Series FX5S-30MT/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-40MT/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-60MT/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-80MT/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-30MR/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-40MR/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-60MR/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-80MR/ESMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-30MT/ESSMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-40MT/ESSMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-60MT/ESSMitsubishi Electric Corporation	1.003 and priorAffected
MELSEC iQ-F Series FX5S-80MT/ESSMitsubishi Electric Corporation	1.003 and priorAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.