HOMEVULNERABILITIESCVE-2022-25162
MEDIUM

CVE-2022-25162

CWE-20Published: May 18, 2022· Updated: Jun 17, 2026

5.3
CVSS v3.1

Official Description

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior and versions prior to 1.073, MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 179**** and prior and versions prior to 1.073, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS) versions prior to 1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) version 1.000 allows a remote unauthenticated attacker to cause a temporary DoS condition for the product's communication by sending specially crafted packets.

NVD Source

Technical Analysis

CVE-2022-25162 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Vendors & Products

mitsubhishielectric48 product(s)
melsec iq-fx5u-32mt\/es firmwaremelsec iq-fx5u-32mt\/esmelsec iq-fx5u-32mt\/ds firmwaremelsec iq-fx5u-32mt\/dsmelsec iq-fx5u-32mt\/ess firmwaremelsec iq-fx5u-32mt\/essmelsec iq-fx5u-32mt\/dss firmwaremelsec iq-fx5u-32mt\/dssmelsec iq-fx5u-32mr\/es firmwaremelsec iq-fx5u-32mr\/esmelsec iq-fx5u-32mr\/ds firmwaremelsec iq-fx5u-32mr\/ds+36
mitsubishielectric146 product(s)
melsec iq-fx5u-32mt\/es firmwaremelsec iq-fx5u-32mt\/esmelsec iq-fx5u-32mt\/ds firmwaremelsec iq-fx5u-32mt\/dsmelsec iq-fx5u-32mt\/ess firmwaremelsec iq-fx5u-32mt\/essmelsec iq-fx5u-32mt\/dss firmwaremelsec iq-fx5u-32mt\/dssmelsec iq-fx5u-32mr\/es firmwaremelsec iq-fx5u-32mr\/esmelsec iq-fx5u-32mr\/ds firmwaremelsec iq-fx5u-32mr\/ds+134
Source: NVD CPE · 194 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

All References (6)

Quick Facts

CVE IDCVE-2022-25162
CVSS Score5.3 / 10
SeverityMEDIUM
WeaknessCWE-20
CISA KEVNo
Affected2 vendor(s)
PublishedMay 18, 2022

Related CVEs (CWE-20)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2022-25162 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.