ICSA-24-338-04

Vulnerability from csaf_cisa - Published: 2024-12-03 07:00 - Updated: 2026-03-10 00:00
Summary
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update B)

Notes

Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
Risk evaluation
Successful exploitation of these vulnerabilities could result in remote code execution.
Critical infrastructure sectors
Critical Manufacturing
Countries/areas deployed
Worldwide
Company headquarters location
United States (Mitsubishi Electric Iconics Digital Solutions), Japan (Mitsubishi Electric)
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
Recommended Practices
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Asher Davila",
          "Malav Vyas"
        ],
        "organization": "Palo Alto Networks",
        "summary": "reported these vulnerabilities to Mitsubishi Electric Iconics Digital Solutions"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in remote code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States (Mitsubishi Electric Iconics Digital Solutions), Japan (Mitsubishi Electric)",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-338-04 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-338-04.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-24-338-04 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks"
      }
    ],
    "title": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update B)",
    "tracking": {
      "current_release_date": "2026-03-10T00:00:00.000000Z",
      "generator": {
        "date": "2026-03-04T22:30:47.746Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.44"
        }
      },
      "id": "ICSA-24-338-04",
      "initial_release_date": "2024-12-03T07:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-12-03T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        },
        {
          "date": "2026-01-08T00:00:00.000000Z",
          "legacy_version": "Update A",
          "number": "2",
          "summary": "Update A - Added GENESIS32."
        },
        {
          "date": "2026-03-10T00:00:00.000000Z",
          "legacy_version": "Update B",
          "number": "3",
          "summary": "Update B - Added ICONICS Suite."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64 and ICONICS Suite AlarmWorX Multimedia (AlarmWorX64 MMX): vers:all/*",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64 and ICONICS Suite AlarmWorX Multimedia (AlarmWorX64 MMX)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "10.97.2|10.97.2_CFR1|10.97.2_CFR2|10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64 and ICONICS Suite: 10.97.2|10.97.2|CFR1|10.97.2|CFR2|10.97.3",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64 and ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric Iconics Digital Solutions"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64 and ICONICS Suite AlarmWorX Multimedia (AlarmWorX64 MMX): vers:all/*",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64 and ICONICS Suite AlarmWorX Multimedia (AlarmWorX64 MMX)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "10.97.2|10.97.2_CFR1|10.97.2_CFR2|10.97.3",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64 and ICONICS Suite:  10.97.2|10.97.2_CFR1|10.97.2_CFR2|10.97.3",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64 and ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric MC Works64: vers:all/*",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric GENESIS32: vers:all/*",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-8299",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A malicious code execution vulnerability due to an uncontrolled search path element (CWE-427) exists in the Phone agent of the multi-agent notification feature in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32. This issue affects users with a Dialogic telephony board without the Dialogic driver installed, or a non-Dialogic telephony board, when using any version of MC Works64 or GENESIS32, or GENESIS64 or ICONICS Suite version 10.97.2 or earlier. Additionally, users of version 10.97.3 or later who have installed the multi-agent notification feature are also affected.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/427.html"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9852"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "For CVE-2024-8299 and CVE-2024-9852, ICONICS Product Suite versions 10.97.3 and later have mitigations for these vulnerabilities. If planning to use the AlarmWorX64 MMX, use the 10.97.3 version and follow the guidelines provided in the ICONICS Whitepaper on Security Vulnerabilities, November 2024 edition (https://iconics.com/About/Security/CERT).",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "no_fix_planned",
          "details": "For GENESIS32 users, there are no plans to release a security patch or a countermeasure version. Version 9 products are in the retired stage of the product lifecycle. As described in the product lifecycle policy (https://iconics.com/en-us/Lifecycle-Policy), these versions are no longer monitored for security vulnerabilities, nor are they being fixed or patched. See the policy for full details.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0007"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the current development version of Mitsubishi Electric Iconics Digital Solutions products as defined in product lifecycle policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note that upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "MC Works64 users should take the mitigations described in the Mitsubishi Electric security advisory (https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf), since there are no plans to release a fix version.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2024-9852",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A malicious code execution vulnerability due to an uncontrolled search path element (CWE-427) exists in the FAX agent of the multi-agent notification feature in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32. This issue affects users of any version of MC Works64 or GENESIS32, as well as GENESIS64 or ICONICS Suite version 10.97.2 or earlier. Additionally, users of version 10.97.3 or later who have installed the multi-agent notification feature are also affected.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/427.html"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9852"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "For CVE-2024-8299 and CVE-2024-9852, ICONICS Product Suite versions 10.97.3 and later have mitigations for these vulnerabilities. If planning to use the AlarmWorX64 MMX, use the 10.97.3 version and follow the guidelines provided in the ICONICS Whitepaper on Security Vulnerabilities, November 2024 edition (https://iconics.com/About/Security/CERT).",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "no_fix_planned",
          "details": "For GENESIS32 users, there are no plans to release a security patch or a countermeasure version. Version 9 products are in the retired stage of the product lifecycle. As described in the product lifecycle policy (https://iconics.com/en-us/Lifecycle-Policy), these versions are no longer monitored for security vulnerabilities, nor are they being fixed or patched. See the policy for full details.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0007"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the current development version of Mitsubishi Electric Iconics Digital Solutions products as defined in product lifecycle policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note that upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "mitigation",
          "details": "MC Works64 users should take the mitigations described in the Mitsubishi Electric security advisory (https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf), since there are no plans to release a fix version.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2024-8300",
      "cwe": {
        "id": "CWE-561",
        "name": "Dead Code"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A dead code issue in the GENESIS64 FA device communications driver can provide the potential for DLL hijacking and malicious code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/561.html"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8300"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "For the highest level of security, it is recommended that users use the current development version of Mitsubishi Electric Iconics Digital Solutions products as defined in product lifecycle policy (GENESIS V11 at the time of this writing) and keep it up to date with the latest releases. Note that upgrading from V9 to V11 may require replacing some of the V9 applications, depending on which applications are being used, with different V11 applications.  Consult Mitsubishi Electric Iconics Digital Solutions on the options for upgrades.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005"
          ],
          "url": "https://iconics.com/en-us/Lifecycle-Policy"
        },
        {
          "category": "vendor_fix",
          "details": "For CVE-2024-8300, security patches corresponding to each version are as follows: If using GENESIS64 and ICONICS Suite version 10.97.2, apply version 10.97.2 Critical Fixes Rollup 3. If using GENESIS64 and ICONICS Suite version 10.97.3 series, apply version 10.97.3 Critical Fixes Rollup 1.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005"
          ]
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend updating GENESIS64 and ICONICS Suite with the latest security updates as they become available. GENESIS64 and ICONICS Suite security updates may be found here (https://partners.iconics.com/Home.aspx) (login required).",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005"
          ],
          "url": "https://partners.iconics.com/Home.aspx"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates as critical fixes/rollup releases. Refer to the ICONICS Whitepaper on security vulnerabilities, the most recent version of which can be found here (https://iconics.com/About/Security/CERT) and to the Mitsubishi Electric security advisory for information on the availability of the security updates. MC Works64 users should take the mitigations described in the Mitsubishi Electric security advisory, since there are no plans to release a fix version.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates as critical fixes/rollup releases. Refer to the ICONICS Whitepaper on security vulnerabilities, the most recent version of which can be found here and to the Mitsubishi Electric security advisory (https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf) for information on the availability of the security updates. MC Works64 users should take the mitigations described in the Mitsubishi Electric security advisory, since there are no plans to release a fix version.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0005"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.