CVE record · CVE-2022-33323

Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series

CVSS 7.5 HighEPSS 0.011 · 66th percentile

Published by the CVE Program (CNA: Mitsubishi) at 2 Feb 2023, 05:49 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-771 of RV-2SD	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-771 of RV-2SDB	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-721 of RV-3SD	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-721 of RV-3SD-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-721 of RV-3SDC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-721 of RV-3SDB	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-721 of RV-3SDB-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDBC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJ	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJ-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJB	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJB-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDJBC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-711 of RV-6SD	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-711 of RV-6SDC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-711 of RV-6SDL	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-711 of RV-6SDLC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-711M of RV-6SDC-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-711M of RV-6SDLC-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-701M of RV-12SD	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-701 of RV-12SDC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-701M of RV-12SDL	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR3D-701 of RV-12SDLC	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-781 of RH-3SDHR3515	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-781 of RH-3SDHR3515C	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR2DA-781 of RH-3SDHR3515W	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH3520	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH3532	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH4520	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH4532	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH5532	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH5520	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH3517M	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH3517M-SM	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH3527M	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH4517M	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH4527M	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH5517M	affected S7x and prior
Mitsubishi Electric Corporation	MELFA SD/SQ Series Controller CR1DA-761 of RH-6SDH5517M-SM	affected S7x and prior

And 404 more products. The full list is on the CVE record.

Identifiers: CVE-2022-33323
CNA: Mitsubishi
Weakness (CWE): CWE-489
Tags: Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR1DA-771 of RV-2SD
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR1DA-721 of RV-3SD
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR1DA-731 of RV-3SDBC
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR2DA-711 of RV-6SD
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR3D-711M of RV-6SDC-SM
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR3D-701M of RV-12SD
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR3D-701 of RV-12SDC
Mitsubishi Electric Corporation MELFA SD/SQ Series Controller CR2DA-781 of RH-3SDHR3515
CWE-489
Published: 2 Feb 2023
Updated: 26 Mar 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	CNA (Mitsubishi)

CISA KEV Not listed.
EPSS 0.011, the 66th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 2 Feb 2023. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.