PatchSiren cyber security CVE debrief

CVE-2024-26314 Mitsubishi Electric CVE debrief

A local privilege escalation vulnerability affects 37 Mitsubishi Electric FA engineering software products. If malicious code executes on a system with affected software installed, a local attacker can gain Windows system privileges and execute arbitrary commands. The vulnerability requires local access, high attack complexity, and user interaction, resulting in a CVSS 3.1 score of 4.4 (Medium). CISA published the initial advisory on May 14, 2024, with the most recent update (Update E) on January 15, 2026, adding version information to affected product and mitigation sections. No known exploitation in ransomware campaigns has been reported.

Vendor: Mitsubishi Electric
Product: CPU Module Logging Configuration Tool
CVSS: MEDIUM 4.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-05-14
Original CVE updated: 2026-06-09
Advisory published: 2024-05-14
Advisory updated: 2026-06-09

Who should care

OT security teams, ICS engineers, manufacturing security personnel, and organizations using Mitsubishi Electric automation software in production environments. Priority for environments with shared engineering workstations or insufficient endpoint protection on HMI/programming devices.

Technical summary

The vulnerability exists in multiple Mitsubishi Electric FA engineering software products where improper privilege management allows local attackers to escalate to Windows system privileges. Attack requires: (1) local access to the system, (2) execution of malicious code, (3) low privileges, and (4) user interaction. The attack complexity is high. Successful exploitation grants integrity impact (arbitrary command execution) but no confidentiality or availability impact per CVSS 3.1 scoring. The vulnerability affects 37 products including major engineering suites (GX Works2/3, GT Designer3, MX Component) and specialized configuration tools.

Defensive priority

medium

Recommended defensive actions

Inventory all Mitsubishi Electric FA engineering software installations across OT and engineering workstation environments
Verify installed versions against affected version thresholds in CISA advisory ICSA-24-135-04
Apply vendor-provided updates: CPU Module Logging Configuration Tool to 1.160S+, CW Configurator to 1.020W+, Data Transfer to 3.59M+, FR Configurator2 to 1.33K+, GT SoftGOT1000 to 3.315D+, GT SoftGOT2000 to 1.320J+, GX 1
LogViewer to 1.160S+, GX Works2 to 1.625B+, GX Works3 to 1.110Q+, MR Configurator2 to 1.155M+
For products requiring purchase contact (CSGL, EZSocket), coordinate with Mitsubishi Electric representatives for update assistance
For end-of-life products without patches (FR Configurator SW3, GX Developer, MI Configurator, MR Configurator, MX OPC Server DA/UA), implement compensating controls: restrict local access, application whitelisting, and 2
network segmentation
Apply defense-in-depth strategies per CISA ICS recommended practices: minimize network exposure, place control system networks behind firewalls, use VPNs for remote access, and monitor for anomalous behavior

Evidence notes

Source: CISA CSAF advisory ICSA-24-135-04 (Update E, published 2026-01-15). CVSS 3.1 vector: AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N. Affected products span engineering workstations including GX Works2, GX Works3, GT Designer3, MX Component, and 33 additional Mitsubishi Electric software packages.

Sources and references

Verified primary and authoritative sources

CVE-2024-26314 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-26314

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-26314 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26314

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-135-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.