Read the docs
TI-2024-07032 Aliases CVE-2024-7587GHSA-564p-h37m-w2xh

Incorrect default permissions in Mitsubishi Electric Corporation GENESIS64

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mitsubishi Electric CorporationGENESIS64up to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationMC Works64All versions—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsGENESIS64up to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationICONICS Suiteup to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsICONICS Suiteup to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationGENESIS32up to 9.70.300.23—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsGENESIS32up to 9.70.300.23—No fix listedCNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*up to 10.97.3VulnerableMitsubishi Electric Iconics Digital Solutions
cpe:2.3:a:mitsubishielectric:mc_works64:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7587
  2. 2026-10-03 Alias added: GHSA-564p-h37m-w2xh

References

Advisory 3

  • TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
  • TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
  • TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
  • TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
  • TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
  • TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences