CVE-2024-7587

highPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.002 · 9. PerzentilEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.19% (9th) EPSS
CVSS 7.8 · high
Is it mine?
34 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenAnalytiXcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates for GENESIS64 and ICONICS Suite as critical fixes and rollup releases. For more information on these security updates, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The most recent version is available at: https://iconicsinc.my.site.com/community/s/login/ .

    https://iconicsinc.my.site.com/community/s/login/
  • BehobenGENESIS64cisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates for GENESIS64 and ICONICS Suite as critical fixes and rollup releases. For more information on these security updates, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The most recent version is available at: https://iconicsinc.my.site.com/community/s/login/ .

    https://iconicsinc.my.site.com/community/s/login/
  • BehobenHyper Historiancisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates for GENESIS64 and ICONICS Suite as critical fixes and rollup releases. For more information on these security updates, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The most recent version is available at: https://iconicsinc.my.site.com/community/s/login/ .

    https://iconicsinc.my.site.com/community/s/login/
  • BehobenICONICS Suitecisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates for GENESIS64 and ICONICS Suite as critical fixes and rollup releases. For more information on these security updates, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The most recent version is available at: https://iconicsinc.my.site.com/community/s/login/ .

    https://iconicsinc.my.site.com/community/s/login/
  • BehobenMobileHMIcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric are releasing security updates for GENESIS64 and ICONICS Suite as critical fixes and rollup releases. For more information on these security updates, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The most recent version is available at: https://iconicsinc.my.site.com/community/s/login/ .

    https://iconicsinc.my.site.com/community/s/login/
  • MitigationAnalytiXcisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationGENESIS32cisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationGENESIS64cisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationHyper Historiancisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationICONICS Suitecisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationMC Works64cisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • MitigationMobileHMIcisa_csaf_ot

    Verify that the permissions on the C:\ProgramData\ICONICS folder do not include "Everyone". If the folder includes "Everyone" permission, manually remove "Everyone" from the folder permissions for the C:\ProgramData\ICONICS folder and all folders under it.

  • Kein Fix geplantGENESIS32cisa_csaf_ot

    For GENESIS32 users, no security patches or fixed versions will be released. Version 9 products have reached the retired stage of the product lifecycle. As outlined in the policy, these versions are no longer monitored for security vulnerabilities and will not receive fixes or patches. Refer to the product lifecycle policy for full details: https://iconics.com/en-us/Lifecycle-Policy .

    https://iconics.com/en-us/Lifecycle-Policy
  • Kein Fix geplantMC Works64cisa_csaf_ot

    There are no plans to release a security update for MC Works64. Users of MC Works64 should refer to the Mitsubishi Electric security advisory and take the recommended actions outlined in the advisory. The most recent version is available at: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-008_en.pdf .

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-008_en.pdf
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpAusnutzbarkeit 1.8 · Auswirkung 5.9
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-276USCWE-276USCWE-276US
05

betroffene Produkte (34)

Betroffene Produkte und Versionsbereiche.

20 von 34 angezeigt
06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-24-296-01Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update C)2024-10-22icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could result in disclosure of confidential information, data tampering, or a denial-of-service condition.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2024-10-22geändert 2026-06-17
09

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan