Vulnerability · Published Nov 28, 2024 · Assigned by Mitsubishi

CVE-2024-9852Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32

High 7.8

In plain English

A high-severity uncontrolled search path in GENESIS32 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 84.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GENESIS64	versions 10.97.3 and prior
Mitsubishi Electric Corporation	ICONICS Suite	versions 10.97.3 and prior
Mitsubishi Electric Corporation	Hyper Historian	versions 10.97.3 and prior
Mitsubishi Electric Corporation	GENESIS32	all versions
Mitsubishi Electric Corporation	MC Works64	all versions
Mitsubishi Electric Iconics Digital Solutions	GENESIS64	versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions	ICONICS Suite	versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions	Hyper Historian	versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions	GENESIS32	all versions

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-010_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU93891820 government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04 government-resource