CVE-2024-8300: Malicious Code Execution Vulnerability in…

Record summary

CVE-2024-8300 has a selected CVSS score of 7.0 (high).

Description

Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 allows a local authenticated attacker to execute a malicious code by tampering with a specially crafted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 29, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
GENESIS64 Browse Mitsubishi Electric Corporation / GENESIS64 Default status: unaffected	CVE List	Version 10.97.2	affected
		Version 10.97.2 CFR1	affected
		Version 10.97.2 CRF2	affected
		Version 10.97.3	affected
ICONICS Suite Browse Mitsubishi Electric Corporation / ICONICS Suite Default status: unaffected	CVE List	Version 10.97.2	affected
		Version 10.97.2 CFR1	affected
		Version 10.97.2 CRF2	affected
		Version 10.97.3	affected
GENESIS64 Browse Mitsubishi Electric Iconics Digital Solutions / GENESIS64 Default status: unaffected	CVE List	Version 10.97.2	affected
		Version 10.97.2 CFR1	affected
		Version 10.97.2 CRF2	affected
		Version 10.97.3	affected
ICONICS Suite Browse Mitsubishi Electric Iconics Digital Solutions / ICONICS Suite Default status: unaffected	CVE List	Version 10.97.2	affected
		Version 10.97.2 CFR1	affected
		Version 10.97.2 CRF2	affected
		Version 10.97.3	affected
genesis64 Browse iconics / genesis64 Default status: unknown	CVE List	10.97.2	affected
		10.97.2cfr1	affected
		10.97.2cfr2	affected
		10.97.3	affected
genesis64 Browse mitsubishielectric / genesis64 Default status: unknown	CVE List	10.97.2	affected
		10.97.2cfr1	affected
		10.97.2cfr2	affected
		10.97.3	affected

References

jvn.jpGovernment resource

https://jvn.jp/vu/JVNVU93891820

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-8300

cisa.govGovernment resource

https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04

mitsubishielectric.comVendor advisory

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf