Unauthorized Access Vulnerability in ICONICS GENESIS64
CVE-2024-1573

5.9MEDIUM

Key Information:

Vendor

Iconics

Status
Genesis64
Mc Works64
Vendor
CVE Published:
4 July 2024

What is CVE-2024-1573?

Improper Authentication vulnerability in the mobile monitoring feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a remote unauthenticated attacker to bypass proper authentication and log in to the system when all of the following conditions are met: * Active Directory is used in the security setting.

  • “Automatic log in” option is enabled in the security setting.
  • The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account.
  • The IcoAnyGlass IIS Application Pool account is included in GENESIS64TM and MC Works64 Security and has permission to log in.

Affected Version(s)

GENESIS64 versions 10.97 to 10.97.2

GENESIS64 versions 10.97 to 10.97.2

MC Works64 all versions

References

https://www.mitsubishielectric.com/en/psirt/vulnerability...
vendor-advisory
https://jvn.jp/vu/JVNVU98894016/
government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-1...
government-resource

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.