Skip to content
Sign in
5.9 Medium

CVE-2024-1573 Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric…

Description

Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric AnalytiX versions 10.97.2 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 and prior, and Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95 allows a remote unauthenticated attacker to bypass proper authentication and log in to the system when all of the following conditions are met: (1) Active Directory is used in the security setting (2) "Automatic log in" option is enabled in the security setting (3) The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, and MC Works64 Security and has permission to log in.

Affected products and versions

Product Affected versions Fixed in
GENESIS64 10.97 10.97 → < 10.97.92 10.97.92
GENESIS64 Versions not published
MC Works64 Versions not published
mc_works64 Versions not published
GENESIS64 Versions not published
ICONICS Suite Versions not published
ICONICS Suite Versions not published
Hyper Historian Versions not published
Hyper Historian Versions not published
Show the 6 other branches
Product Affected versions Fixed in
AnalytiX Versions not published
AnalytiX Versions not published
MobileHMI Versions not published
MobileHMI Versions not published
IoTWorX Versions not published
IoTWorX Versions not published

Other CVEs of GENESIS64

The 8 CVEs of GENESIS64 →
CVE-2024-9852 Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi… 7.8 High CVE-2024-8300 Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3,… 7.0 High CVE-2024-8299 Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi… 7.8 High CVE-2024-7587 Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi… 7.8 High
Track this CVE