CVE-2024-8299
highPriorität · verfolgen · 0EPSS 0.002 · 15. PerzentilEURUUSEPSS · bewertet 2026-10-27
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or to cause a denial of service (DoS) condition on the products.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenGENESIS64cisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - BehobenHyper Historiancisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - BehobenICONICS Suitecisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - MitigationGENESIS32cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationGENESIS64cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationHyper Historiancisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationICONICS Suitecisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationMC Works64cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- Kein Fix geplantGENESIS32cisa_csaf_ot
There are no plans to release fixed versions for MC Works64 and GENESIS32. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- Kein Fix geplantGENESIS64cisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- Kein Fix geplantHyper Historiancisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- Kein Fix geplantICONICS Suitecisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- Kein Fix geplantMC Works64cisa_csaf_ot
There are no plans to release fixed versions for MC Works64 and GENESIS32. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (28)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-24-338-04Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update C)2024-12-03icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder or tampering with a specially crafted DLL. This could lead to disclose information in the affected products, tamper with, destroy or delete information in the affected products, or cause a denial of service (DoS) condition on the products.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (11)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-8299cnnvd
- https://jvn.jp/vu/JVNVU93891820cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-8299cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU93891820enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04enisa_euvd
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-010_en.pdfenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan