PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-8300 Mitsubishi Electric Iconics Digital Solutions CVE debrief

A malicious code execution vulnerability exists in the FA device communication driver of GENESIS64 and ICONICS Suite due to dead code (CWE-561). The vulnerability affects users who install affected products in an unprotected folder other than the default installation folder. The CVSS 3.1 vector indicates local attack vector with high attack complexity, low privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability. The advisory was initially published on 2024-12-03 and has undergone three updates: Update A (2026-01-08) added GENESIS32, Update B (2026-03-10) added ICONICS Suite, and Update C (2026-04-07) added fixed versions. Affected versions include GENESIS64 and ICONICS Suite 10.97.2 series (10.97.2, 10.97.2 CFR1, 10.97.2 CFR2) and 10.97.3 series. Vendor fixes are available through critical fixes rollups.

Vendor
Mitsubishi Electric Iconics Digital Solutions
Product
GENESIS64
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-03
Original CVE updated
2026-04-07
Advisory published
2024-12-03
Advisory updated
2026-04-07

Who should care

Organizations operating industrial control systems and SCADA/HMI environments using GENESIS64 or ICONICS Suite for process visualization and control, particularly those in manufacturing, energy, water/wastewater, and critical infrastructure sectors. System administrators responsible for deployment configurations and security teams managing OT/ICS security postures should prioritize assessment and remediation.

Technical summary

The vulnerability stems from dead code present in the FA device communication driver. When affected products are installed in non-default, unprotected folders rather than the default installation directory, this dead code can be leveraged for malicious code execution. The attack requires local access with low privileges but no user interaction, potentially resulting in complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) provides some mitigation against exploitation. The vulnerability affects both Mitsubishi Electric-branded and Mitsubishi Electric Iconics Digital Solutions-branded versions of GENESIS64 and ICONICS Suite.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fixes: For GENESIS64 and ICONICS Suite Version 10.97.2 series, install '10.97.2 Critical Fixes Rollup 3'. For Version 10.97.3 series, install '10.97.3 Critical Fixes Rollup 2'.
  • If immediate patching is not possible, install affected products only in the default protected installation folder, not in unprotected non-default locations.
  • Restrict network access by blocking remote login from untrusted networks, hosts, and users for systems running affected products.
  • Implement firewall or VPN controls to prevent unauthorized access when connecting affected systems to the Internet, allowing remote access only to trusted users.
  • Restrict physical access to systems running affected products and their connected networks.
  • Train users to avoid clicking web links or opening attachments from untrusted email sources.
  • Monitor Mitsubishi Electric security advisory and ICONICS GENESIS64 security updates page for additional guidance.

Evidence notes

Source: CISA ICS Advisory ICSA-24-338-04 (Update C). CVSS 3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-561 (Dead Code). Affected products confirmed through CSAFPID-0002, CSAFPID-0004, CSAFPID-0009, CSAFPID-0011.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-8300 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-8300

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-8300 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-8300

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-338-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.