High severity · published Oct 22, 2024
CVE-2024-7587
Information Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GENESIS32 · Mitsubishi Electric Iconics Digital Solutions
Versions 9.70.300.23 and prior · source: vendor
GE
GENESIS64 · Mitsubishi Electric Corporation
Versions 10.97.3 and prior · source: vendor, NVD, CISA
IS
ICONICS Suite · Mitsubishi Electric Iconics Digital Solutions
Versions 10.97.3 and prior · source: vendor
MW
MC Works64 · Mitsubishi Electric Corporation
All versions · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7587
Mitigation
https://jvn.jp/vu/JVNVU95548104
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf
More from GENESIS32
9.2
CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
7.8
CVE-2024-9852
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.8
CVE-2024-8299
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.1
CVE-2026-16437
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
7.0
CVE-2024-1182
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior,…