CVE-2024-8299
highpriority · track · 0EPSS 0.002 · 15 %ileEURUUSEPSS · scored 2026-10-27
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or to cause a denial of service (DoS) condition on the products.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedGENESIS64cisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - FixedHyper Historiancisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - FixedICONICS Suitecisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Phone agent, download and install Version 10.98 or later from the link (https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905).
https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905 - MitigationGENESIS32cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationGENESIS64cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationHyper Historiancisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationICONICS Suitecisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- MitigationMC Works64cisa_csaf_ot
For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- No fix plannedGENESIS32cisa_csaf_ot
There are no plans to release fixed versions for MC Works64 and GENESIS32. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- No fix plannedGENESIS64cisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- No fix plannedHyper Historiancisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- No fix plannedICONICS Suitecisa_csaf_ot
For GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Phone agent and are using a Dialogic telephony board, install the driver provided by Dialogic. For GENESIS64 and ICONICS Suite users who need to use the Phone agent and are using a non-Dialogic telephony board, there are no plans to release a fixed version for the Phone agent. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
- No fix plannedMC Works64cisa_csaf_ot
There are no plans to release fixed versions for MC Works64 and GENESIS32. If you do not need to use the multi-agent notification feature, uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64 and ICONICS Suite version 10.97.3 or later. For users who need to use the multi-agent notification feature, and do not need to use the Phone agent, execute a custom installation of the multi-agent notification feature and skip the installation of the Phone agent.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-24-338-04Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update C)2024-12-03icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder or tampering with a specially crafted DLL. This could lead to disclose information in the affected products, tamper with, destroy or delete information in the affected products, or cause a denial of service (DoS) condition on the products.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-8299cnnvd
- https://jvn.jp/vu/JVNVU93891820cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-8299cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU93891820enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04enisa_euvd
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-010_en.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan