CVE-2024-3904

HIGH

Mitsubishi MELIPC MI5122-VW Gateway 05-07 - Local Code Execution

Title source: manual
STIX 2.1

Description

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to execute arbitrary code by saving a malicious file to a specific folder. As a result, the attacker may disclose, tamper with, destroy or delete information in the product, or cause a denial-of-service (DoS) condition on the product.

References (3)

Core 3
Core References
Third Party Advisory, US Government Resource government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-02
Third Party Advisory government-resource
https://jvn.jp/vu/JVNVU91215350/index.html

Scores

CVSS v3 8.8
EPSS 0.0016
EPSS Percentile 6.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-276
Status published
Products (1)
Mitsubishi Electric Corporation/MELIPC Series MI5122-VW Firmware versions "05" to "07"
Published Jul 04, 2024
Tracked Since Feb 18, 2026