Products
Mitsubishi Electric MC Works64
ICONICS GENESIS64
- 10.97 - 10.97.2
Mitsubishi Electric GENESIS64
- 10.97 - 10.97.2
Source
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Tags
CVE-2024-1574 details
Last Modified : July 4, 2024, 9:15 a.m.
Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.7 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
6.7
Exploitability Score
0.8
Impact Score
5.9
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://jvn.jp/vu/JVNVU98894016/ | Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp |
| https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03 | Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp |
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf | Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp |