High severity · published Jul 4, 2024
CVE-2024-1182
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior,…
7.0
CVSS
0.3%
EPSS
No
On KEV
Description
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GENESIS32 · Mitsubishi Electric Corporation
versions 9.7 and prior · source: vendor
GE
GENESIS64 · Mitsubishi Electric Corporation
10.97.3 and prior · source: vendor, CISA
HH
Hyper Historian · Mitsubishi Electric Corporation
10.97.3 and prior · source: vendor
IS
ICONICS Suite · Mitsubishi Electric Corporation
10.97.3 and prior · source: vendor
MW
MC Works64 · Mitsubishi Electric Corporation
all versions · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1182
jvn.jp
https://jvn.jp/vu/JVNVU98894016/
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
www.mitsubishielectric.com
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf
More from GENESIS32
9.2
CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
7.8
CVE-2024-9852
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.8
CVE-2024-8299
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.8
CVE-2024-7587
Information Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32
7.1
CVE-2026-16437
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz