CVE-2024-1573

mediumpriority · track · 0OT risk · elevatedEPSS 0.006 · 47 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.59% (47th) EPSS
CVSS 5.9 · medium
Is it mine?
33 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-22

Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric AnalytiX versions 10.97.2 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 and prior, and Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95 allows a remote unauthenticated attacker to bypass proper authentication and log in to the system when all of the following conditions are met: (1) Active Directory is used in the security setting (2) "Automatic log in" option is enabled in the security setting (3) The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, and MC Works64 Security and has permission to log in.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAnalytiXcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedAnalytiXcisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedGENESIS64cisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedGENESIS64cisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedHyper Historiancisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedHyper Historiancisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedICONICS Suitecisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedICONICS Suitecisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedIoTWorXcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for IoTWorX. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedIoTWorXcisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for IoTWorX. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedMobileHMIcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedMobileHMIcisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • MitigationAnalytiXcisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationGENESIS64cisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationHyper Historiancisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationICONICS Suitecisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationIoTWorXcisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationMC Works64cisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • MitigationMobileHMIcisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) "Automatic log in"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in.

  • No fix plannedMC Works64cisa_csaf_ot

    Please take the mitigations since there are no plans to release a security update for Mitsubishi Electric MC Works64.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.9
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · CISA US
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpexploitability 2.2 · impact 3.6
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306US
05

affected products (33)

Products and version ranges known to be affected.

showing 20 of 33
06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-24-184-03Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update E)2024-06-27icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could result in denial-of-service, improper privilege management, or potentially arbitrary code execution.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2024-07-04modified 2026-06-17
09

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan