Log in Start free

Vulnerability · Published Nov 28, 2024 · Assigned by Mitsubishi

CVE-2024-8300Malicious Code Execution Vulnerability in GENESIS64 and ICONICS Suite

High 7.0

In plain English

A high-severity security flaw in GENESIS64 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 allows a local authenticated attacker to execute a malicious code by tampering with a specially crafted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation GENESIS64 Version 10.97.2Version 10.97.2 CFR1Version 10.97.2 CRF2Version 10.97.3
Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2Version 10.97.2 CFR1Version 10.97.2 CRF2Version 10.97.3
Mitsubishi Electric Corporation ICONICS Suite Version 10.97.2Version 10.97.2 CFR1Version 10.97.2 CRF2Version 10.97.3
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite Version 10.97.2Version 10.97.2 CFR1Version 10.97.2 CRF2Version 10.97.3

Weakness: CWE-561 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References