PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-1574 Mitsubishi Electric Iconics Digital Solutions CVE debrief

A local arbitrary code execution vulnerability exists in the licensing feature of multiple Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions products. The vulnerability stems from unsafe reflection (CWE-470), where externally-controlled input can be used to select classes or code. A local attacker with low privileges can execute arbitrary code with administrative privileges by tampering with a specific unprotected file. The vulnerability was initially published on July 2, 2024, and has been updated multiple times through April 7, 2026 (Update D), which added Hyper Historian, AnalytiX, and MobileHMI to the affected products list. The CVSS 3.1 score is 6.7 (Medium), with a vector of AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, high attack complexity, low privileges required, user interaction required, but high impact on confidentiality, integrity, and availability.

Vendor
Mitsubishi Electric Iconics Digital Solutions
Product
ICONICS Suite
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-27
Original CVE updated
2026-06-04
Advisory published
2024-06-27
Advisory updated
2026-06-04

Who should care

Organizations running Mitsubishi Electric or Mitsubishi Electric Iconics Digital Solutions HMI/SCADA products in industrial control environments, particularly those with ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX, MobileHMI, GENESIS32, BizViz, or MC Works64 deployments. Critical infrastructure operators and manufacturing facilities using these products for process visualization and control should prioritize assessment and remediation.

Technical summary

The vulnerability exists in the licensing feature of affected products due to unsafe reflection (CWE-470), where externally-controlled input can select classes or code. A local attacker with low privileges can tamper with a specific unprotected file to execute arbitrary code with administrative privileges. The attack requires high complexity and user interaction but results in complete system compromise (high confidentiality, integrity, and availability impact).

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fix version 10.97.3 or later for ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX, and MobileHMI products where available
  • For GENESIS32, BizViz, and MC Works64 products with no planned fix, implement network segmentation by placing control system networks and devices behind firewalls
  • Restrict physical access to systems running affected products to prevent unauthorized local access
  • Implement user awareness training to prevent clicking web links or opening attachments from untrusted sources
  • Monitor for unauthorized file modifications in licensing-related directories
  • Review and apply ICS-CERT recommended practices for defense in depth strategies

Evidence notes

The vulnerability affects 15 product variants across two vendor lines: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric. Affected products include ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX, MobileHMI (all <=10.97.2), GENESIS32 and BizViz (<=9.7), and MC Works64 (all versions). Fixed versions (10.97.3 or later) are available for ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX, and MobileHMI. No fix is planned for GENESIS32, BizViz, or MC Works64; these require network segmentation and physical access controls.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-1574 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-1574

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-1574 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-1574

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-184-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.