CVE-2024-9852
Malicious Code Execution Vulnerability in GENESIS64 and MC Works64
Severity Score
7.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.
*Credits:
Asher Davila of Palo Alto Networks, Malav Vyas of Palo Alto Networks
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-10-11 CVE Reserved
- 2024-11-28 CVE Published
- 2024-12-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-427: Uncontrolled Search Path Element
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://jvn.jp/vu/JVNVU93891820 | Government Resource | |
| https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04 | Government Resource |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf | 2024-11-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mitsubishi Electric Corporation Search vendor "Mitsubishi Electric Corporation" | GENESIS64 Search vendor "Mitsubishi Electric Corporation" for product "GENESIS64" | <= Search vendor "Mitsubishi Electric Corporation" for product "GENESIS64" and version " <= " | en |
Affected
| ||||||
| Mitsubishi Electric Corporation Search vendor "Mitsubishi Electric Corporation" | MC Works64 Search vendor "Mitsubishi Electric Corporation" for product "MC Works64" | <= Search vendor "Mitsubishi Electric Corporation" for product "MC Works64" and version " <= " | en |
Affected
| ||||||
| ICONICS Search vendor "ICONICS" | GENESIS64 Search vendor "ICONICS" for product "GENESIS64" | <= Search vendor "ICONICS" for product "GENESIS64" and version " <= " | en |
Affected
| ||||||