SARA / Free Tools / CVE / CVE-2022-40267

CVE-2022-40267 — Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsu

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ

CVSS
5.9 MEDIUM
EPSS
2.18% (top 15.80%)
CWE
CWE-337
Published
2023-01-20T07:52:56.784Z
Last modified
2024-08-03T12:14:39.972Z
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

01What is this vulnerability?

Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179 and prior, and versions 1.074 and…

02Affected products

VendorProductVersions
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MT/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MT/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Seres FX5U-80MT/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MR/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MR/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-80MR/ES — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MT/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MT/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-80MT/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MR/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MR/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-80MR/DS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MT/ESS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MT/ESS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-80MT/ESS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-32MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-64MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5U-80MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-32MT/D — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-64MT/D — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-96MT/D — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-32MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-64MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-96MT/DSS — serial number 17X**** or later, and versions 1.280 and prior, serial number 179**** and prior, and versions 1.074 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-32MT/DS-TS — versions 1.280 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-32MT/DSS-TS — versions 1.280 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UC-32MR/DS-TS — versions 1.280 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R00CPU — versions 33 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R01CPU — versions 33 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R02CPU — versions 33 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R04CPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R08CPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R16CPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R32CPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R120CPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R04ENCPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R08ENCPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R16ENCPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R32ENCPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQR Series R120ENCPU — versions 66 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-24MT/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-40MT/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-60MT/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-24MR/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-40MR/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-60MR/ES — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-24MT/ESS — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-40MT/ESS — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-60MT/ESS — 1.042 and prior
Mitsubishi Electric CorporationMELSEC iQF Series FX5UJ-24MT/ES-A — 1.043 and prior

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

09References

Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →