Uncontrolled Search Path Element Vulnerability in ICONICS GENESIS64 All Versions

CVE-2024-1182

What is CVE-2024-1182?

CVE-2024-1182 is a vulnerability found in ICONICS GENESIS64, Mitsubishi Electric GENESIS64, and MC Works64 software, which are utilized for industrial automation and control. This vulnerability allows local attackers to exploit an uncontrolled search path element. By placing a specially crafted Dynamic-Link Library (DLL) in designated folders, an attacker could execute unauthorized code, potentially compromising the integrity and functionality of the software systems. Organizations relying on these platforms may face operational disruptions, data integrity issues, or unauthorized access to sensitive information.

Technical Details

This peril originates from an uncontrolled search path element vulnerability inherent in all versions of the affected products. Specifically, it manifests when the software is configured with the Pager agent as part of the alarm multi-agent notification feature. The structure of the software allows local adversaries to place malicious DLL files in specific directories, paving the way for harmful code execution upon application launch. This issue is particularly alarming considering the common deployment of such software in critical industrial environments.

Potential Impact of CVE-2024-1182

1. Unauthorized Code Execution: The primary risk is that local attackers can gain the ability to execute arbitrary code, which may lead to complete system takeover or manipulation of the software's functions.

2. Operational Disruption: Organizations may experience significant disruptions in their operational processes, as the malicious code could alter the normal functioning of automation and control measures, leading to potential downtime.

3. Data Breach Risks: The vulnerability could expose sensitive operational data and configurations, potentially leading to data theft or leakage that could be exploited by malicious actors for further attacks or to gain competitive advantages.

References