CVE-2024-1574

July 4, 2024, 9:15 a.m.

CVSS Score

6.7 / 10

Product(s) Impacted

Mitsubishi Electric MC Works64

ICONICS GENESIS64

  • 10.97 - 10.97.2

Mitsubishi Electric GENESIS64

  • 10.97 - 10.97.2

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system.

Weaknesses

CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

CWE ID: 470

Date

Published: July 4, 2024, 9:15 a.m.

Last Modified: July 4, 2024, 9:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score
6.7
Exploitability Score
0.8
Impact Score
5.9
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://jvn.jp/vu/JVNVU98894016/
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp