What’s Vulnerable › Vulnerabilities

CVE-2024-8300: Malicious Code Execution Vulnerability in GENESIS64 and ICONICS Suite

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-28 · updated 2026-06-17
• Weakness: CWE-561

Description

Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 allows a local authenticated attacker to execute a malicious code by tampering with a specially crafted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

Affected products

• ICONICS and Mitsubishi Electric Corporation GENESIS64: 10.97.2, 10.97.2cfr1, 10.97.2cfr2, 10.97.3
• Mitsubishi Electric Corporation GENESIS64: 10.97.2, 10.97.2cfr1, 10.97.2cfr2, 10.97.3

References

• https://jvn.jp/vu/JVNVU93891820
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf

Get alerted when CVE-2024-8300 or the next vulnerability affects your stack