CVE-2024-1573

Severity Score

5.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Improper Authentication vulnerability in the mobile monitoring feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a remote unauthenticated attacker to bypass proper authentication and log in to the system when all of the following conditions are met: * Active Directory is used in the security setting.
* “Automatic log in” option is enabled in the security setting.
* The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account.
* The IcoAnyGlass IIS Application Pool account is included in GENESIS64TM and MC Works64 Security and has permission to log in.

Vulnerabilidad de autenticación incorrecta en la función de monitoreo móvil de ICONICS GENESIS64 versiones 10.97 a 10.97.2, Mitsubishi Electric GENESIS64 versiones 10.97 a 10.97.2 y Mitsubishi Electric MC Works64 todas las versiones permite que un atacante remoto no autenticado omita la autenticación adecuada e inicie sesión en el sistema cuando Se cumplen todas las condiciones siguientes: * Se utiliza Active Directory en la configuración de seguridad. * La opción "Inicio de sesión automático" está habilitada en la configuración de seguridad. * El grupo de aplicaciones IcoAnyGlass IIS se ejecuta en una cuenta de dominio de Active Directory. * La cuenta del grupo de aplicaciones IcoAnyGlass IIS está incluida en GENESIS64TM y MC Works64 Security y tiene permiso para iniciar sesión.

*Credits: N/A

CVSS Scores

Mitsubishi Electric Corporationv3.1 5.9

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-02-16 CVE Reserved
2024-07-04 CVE Published
2024-07-05 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-287: Improper Authentication

CAPEC

CAPEC-115: Authentication Bypass

References (3)

URL	Tag	Source
https://jvn.jp/vu/JVNVU98894016	Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03	Government Resource

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf	2024-07-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mitsubishi Electric Corporation Search vendor "Mitsubishi Electric Corporation"		MC Works64 Search vendor "Mitsubishi Electric Corporation" for product "MC Works64"				*		en		Affected