CVE-2022-40267— Authentication Bypass Vulnerability in Web Server Function on MELSEC Series
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-40267
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authentication Bypass Vulnerability in Web Server Function on MELSEC Series
Source: NVD (National Vulnerability Database)
Vulnerability Description
Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numbers.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
PRNG中使用可预测种子
Source: NVD (National Vulnerability Database)
Vulnerability Title
Mitsubishi Electric MELSEC iQ-F series 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric MELSEC iQ-F series是日本三菱电机（Mitsubishi Electric）公司的一款可编程逻辑控制器。 Mitsubishi Electric MELSEC iQ-F series v1.240 版本存在安全漏洞，该漏洞源于特制的 HTTP 请求可能导致会话 cookie 泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-40267
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-40267
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: MELSEC iQ-F Series FX5U-32MT/ES
- CVE-2025-10259
Denial-of-Service(DoS) Vulnerability in TCP Communication Fu - CVE-2025-7731
Information Disclosure Vulnerability in MELSEC iQ-F Series C - CVE-2025-7405
Information Disclosure, Information Tampering, and Denial of - CVE-2025-5514
Denial-of-Service(DoS) Vulnerability in Web server function - CVE-2025-5241
Denial-of-Service Vulnerability in MELSEC iQ-F Series
Same vendor: Mitsubishi Electric Corporation
- CVE-2025-14816
Information Disclosure, Tampering, and Denial-of-Service Vul - CVE-2025-14815
Information Disclosure, Tampering, and Denial-of-Service Vul - CVE-2025-2399
Denial of Service (DoS) Vulnerability in Mitsubishi Electric - CVE-2026-1876
Denial-of-Service (DoS) vulnerability in Ethernet function o - CVE-2026-1875
Denial-of-Service (DoS) vulnerability in Ethernet function o
Same weakness: CWE-337
- CVE-2026-26018
CoreDNS Loop Detection Denial of Service Vulnerability - CVE-2026-25235
PEAR Has a Predictable Verification Hash in Election Account - CVE-2025-62710
Sakai kernel-impl: predictable PRNG used to generate server‑ - CVE-2025-55069
AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Rando - CVE-2025-7770
Predictable Seed in Pseudo-Random Number Generator (PRNG) in
V. Comments for CVE-2022-40267
No comments yet