High severity · published Nov 28, 2024
CVE-2024-8299
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or to cause a denial of service (DoS) condition on the products.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GENESIS32 · Mitsubishi Electric Corporation
all versions · source: vendor
GE
GENESIS64 · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor, CISA
HH
Hyper Historian · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
IS
ICONICS Suite · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
MW
MC Works64 · Mitsubishi Electric Corporation
all versions · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8299
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8299
jvn.jp
https://jvn.jp/vu/JVNVU93891820
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-010_en.pdf
More from GENESIS32
9.2
CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
7.8
CVE-2024-9852
Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
7.1
CVE-2026-16437
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
6.5
CVE-2025-0921
Information Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz
