{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Asher Davila",
          "Malav Vyas"
        ],
        "organization": "Palo Alto Networks",
        "summary": "reported CVE-2024-1182 to Mitsubishi Electric Iconics Digital Solutions."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in denial-of-service, improper privilege management, or potentially arbitrary code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "other",
        "text": "Japan",
        "title": "Company headquarters location"
      },
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "other",
        "text": "This ICSA is a verbatim republication of Mitsubishi Electric 2024-004 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory.  Further, CISA does not endorse any commercial product or service.  Contact CISA directly for any questions regarding this advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-184-03 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      }
    ],
    "title": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update D)",
    "tracking": {
      "current_release_date": "2026-04-07T06:00:00.000000Z",
      "generator": {
        "date": "2026-04-01T14:45:16.761115Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.5.0"
        }
      },
      "id": "ICSA-24-184-03",
      "initial_release_date": "2024-07-02T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-07-02T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        },
        {
          "date": "2024-12-03T07:00:00.000000Z",
          "legacy_version": "Update A",
          "number": "2",
          "summary": "Update A - Added Mitsubishi Electric MC Works64, re-categorized CVE-2023-4807 as CWE-347."
        },
        {
          "date": "2026-01-08T07:00:00.000000Z",
          "legacy_version": "Update B",
          "number": "3",
          "summary": "Update B - Added GENESIS32."
        },
        {
          "date": "2026-03-03T00:00:00.000000Z",
          "legacy_version": "Update C",
          "number": "4",
          "summary": "Update C - Fixes for affected versions and typographical errors"
        },
        {
          "date": "2026-04-07T00:00:00.000000Z",
          "legacy_version": "Update D",
          "number": "5",
          "summary": "Update D - Added Hyper Historian, AnaltitiX, and MobileHMI for affected products"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: 10.97.2",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: \u003c=10.97.2",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: \u003c=10.97.3",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64: 10.97.2",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64: \u003c=10.97.2",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64: \u003c=10.97.3",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Hyper Historian: 10.97.2",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Hyper Historian: \u003c=10.97.2",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Hyper Historian: \u003c=10.97.3",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "Hyper Historian"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions AnalytiX: 10.97.2",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions AnalytiX: \u003c=10.97.2",
                  "product_id": "CSAFPID-0011"
                }
              }
            ],
            "category": "product_name",
            "name": "AnalytiX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions MobileHMI: 10.97.2",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions MobileHMI: \u003c=10.97.2",
                  "product_id": "CSAFPID-0013"
                }
              }
            ],
            "category": "product_name",
            "name": "MobileHMI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.7",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS32: \u003c=9.7",
                  "product_id": "CSAFPID-0014"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.7",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions BizViz: \u003c=9.7",
                  "product_id": "CSAFPID-0015"
                }
              }
            ],
            "category": "product_name",
            "name": "BizViz"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.95",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions IoTWorX: 10.95",
                  "product_id": "CSAFPID-0016"
                }
              }
            ],
            "category": "product_name",
            "name": "IoTWorX"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric Iconics Digital Solutions"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric ICONICS Suite: 10.97.2",
                  "product_id": "CSAFPID-0017"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric ICONICS Suite: \u003c=10.97.2",
                  "product_id": "CSAFPID-0018"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric ICONICS Suite: \u003c=10.97.3",
                  "product_id": "CSAFPID-0019"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64: 10.97.2",
                  "product_id": "CSAFPID-0020"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64: \u003c=10.97.2",
                  "product_id": "CSAFPID-0021"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64: \u003c=10.97.3",
                  "product_id": "CSAFPID-0022"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Hyper Historian: 10.97.2",
                  "product_id": "CSAFPID-0023"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric Hyper Historian: \u003c=10.97.2",
                  "product_id": "CSAFPID-0024"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Hyper Historian: \u003c=10.97.3",
                  "product_id": "CSAFPID-0025"
                }
              }
            ],
            "category": "product_name",
            "name": "Hyper Historian"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric AnalytiX: 10.97.2",
                  "product_id": "CSAFPID-0026"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric AnalytiX: \u003c=10.97.2",
                  "product_id": "CSAFPID-0027"
                }
              }
            ],
            "category": "product_name",
            "name": "AnalytiX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.97.2",
                "product": {
                  "name": "Mitsubishi Electric MobileHMI: 10.97.2",
                  "product_id": "CSAFPID-0028"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.2",
                "product": {
                  "name": "Mitsubishi Electric MobileHMI: \u003c=10.97.2",
                  "product_id": "CSAFPID-0029"
                }
              }
            ],
            "category": "product_name",
            "name": "MobileHMI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.7",
                "product": {
                  "name": "Mitsubishi Electric GENESIS32: \u003c=9.7",
                  "product_id": "CSAFPID-0030"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.7",
                "product": {
                  "name": "Mitsubishi Electric BizViz: \u003c=9.7",
                  "product_id": "CSAFPID-0031"
                }
              }
            ],
            "category": "product_name",
            "name": "BizViz"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric MC Works64: vers:all/*",
                  "product_id": "CSAFPID-0032"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.95",
                "product": {
                  "name": "Mitsubishi Electric IoTWorX: 10.95",
                  "product_id": "CSAFPID-0033"
                }
              }
            ],
            "category": "product_name",
            "name": "IoTWorX"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-2650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When the BACnet Secure Connect feature is enabled in the affected products, a temporary denial-of-service vulnerability due to allocation of resources without limits or throttling exists in the OpenSSL library integrated into the products, during data validation. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending a certificate that contains a specially crafted ANS 1 OBJECT IDENTIFIER.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:P/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0004",
          "CSAFPID-0007",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0017",
          "CSAFPID-0020",
          "CSAFPID-0023",
          "CSAFPID-0026",
          "CSAFPID-0028"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/770.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\" and install it. For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend restricting physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the user from clicking on web links in e-mails or other messages from untrusted sources, or from opening attachments in untrusted e-mails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend disabling the BACnet Secure Connect feature if it is enabled. Note that this function is installed on GENESIS64 and ICONICS Suite as the beta version and it is disabled by the default configuration. Refer to ICONICS Product Help (https://docs.iconics.com/V10.97.2/GENESIS64/Help/Apps/WBDT/BACnet_SC/Overview_of_BACnet_SC.htm) for the procedure to disable this function.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ],
          "url": "https://docs.iconics.com/V10.97.2/GENESIS64/Help/Apps/WBDT/BACnet_SC/Overview_of_BACnet_SC.htm"
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing importing certificates from untrusted sources, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-4807",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When running on X86_64 CPUs supporting AVX512-IFMA instructions and the BACnet Secure Connect feature is enabled in the affected products, a denial-of-service vulnerability due to improper verification of cryptographic signature exists in the Message Authentication Code (MAC) implementation in OpenSSL library integrated into the products. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending messages that contain specially crafted Message Authentication Code (MAC).",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:P/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0004",
          "CSAFPID-0007",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0017",
          "CSAFPID-0020",
          "CSAFPID-0023",
          "CSAFPID-0026",
          "CSAFPID-0028"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-4807"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/347.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend restricting physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the user from clicking on web links in e-mails or other messages from untrusted sources, or from opening attachments in untrusted e-mails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend disabling the BACnet Secure Connect feature if it is enabled. Note that this function is installed on the affected products as the beta version and it is disabled by the default configuration. Refer to ICONICS Product Help (https://docs.iconics.com/V10.97.2/GENESIS64/Help/Apps/WBDT/BACnet_SC/Overview_of_BACnet_SC.htm) for the procedure to disable this function.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ],
          "url": "https://docs.iconics.com/V10.97.2/GENESIS64/Help/Apps/WBDT/BACnet_SC/Overview_of_BACnet_SC.htm"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0004",
            "CSAFPID-0007",
            "CSAFPID-0010",
            "CSAFPID-0012",
            "CSAFPID-0017",
            "CSAFPID-0020",
            "CSAFPID-0023",
            "CSAFPID-0026",
            "CSAFPID-0028"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2024-1182",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When the affected products are installed with the Pager agent in the multi-agent notification feature, an arbitrary code execution vulnerability due to uncontrolled search path element exists in the feature. This vulnerability allows a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003",
          "CSAFPID-0006",
          "CSAFPID-0014",
          "CSAFPID-0019",
          "CSAFPID-0022",
          "CSAFPID-0030",
          "CSAFPID-0032",
          "CSAFPID-0009",
          "CSAFPID-0025"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1182"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/427.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Pager agent, download the fixed version 10.98 of later from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905\" and install it. For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0009"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "vendor_fix",
          "details": "For Mitsubishi Electric GENESIS64, ICONICS Suite, and Hyper Historian users who do not need to use the Pager agent, download the fixed version 10.98 of later from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0025"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "no_fix_planned",
          "details": "For Mitsubishi Electric Iconics Digital Solutions GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Pager agent: The affected feature, the multi-agent notification feature, is no longer the part of the default installation for GENESIS64 and ICONICS Suite Version 10.97.3 and later. Do not custom install this feature unless you specifically need it. For GENESIS32 and MC Works64, do not install the multi-agent notification feature.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "For Mitsubishi Electric GENESIS64, ICONICS Suite, and Hyper Historian users who need to use the Pager agent: The affected feature, the multi-agent notification feature, is no longer the part of the default installation for GENESIS64 and ICONICS Suite Version 10.97.3 and later. Do not custom install this feature unless you specifically need it. For GENESIS32 and MC Works64, do not install the multi-agent notification feature.",
          "product_ids": [
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0025"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "There are no plans to release a security update for Mitsubishi Electric Iconics Digital Solutions GENESIS32. The affected feature, the multi-agent notification feature, is no longer the part of the default installation for GENESIS64 and ICONICS Suite Version 10.97.3 and later. Do not custom install this feature unless you specifically need it. For GENESIS32 and MC Works64, do not install the multi-agent notification feature.",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "There are no plans to release a security update for Mitsubishi Electric GENESIS32 and MC Works64. In the security settings, ensure that at least one of the following four conditions is not met. Active Directory is used in the security setting. \u201cAutomatic log in\u201d option is enabled in the security setting. The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONICS Suite and MC Works64 Security and has permission to log in.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0014",
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0030",
            "CSAFPID-0032",
            "CSAFPID-0009",
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend restricting physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0014",
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0030",
            "CSAFPID-0032",
            "CSAFPID-0009",
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the user from clicking on web links in e-mails or other messages from untrusted sources, or from opening attachments in untrusted e-mails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0014",
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0030",
            "CSAFPID-0032",
            "CSAFPID-0009",
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of GENESIS64, ICONICS Suite, and Hyper Historian that do not have a fixed version, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing from custom installing this feature unless you specifically need it. The affected feature, the multi-agent notification feature, is no longer the part of the default installation for GENESIS64, ICONICS Suite, and Hyper Historian Version 10.97.3 and later. For users of GENESIS32 and MC Works64 that do not have a fixed version, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the  installation of the the multi-agent notification feature.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0014",
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0030",
            "CSAFPID-0032",
            "CSAFPID-0009",
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003",
            "CSAFPID-0006",
            "CSAFPID-0014",
            "CSAFPID-0019",
            "CSAFPID-0022",
            "CSAFPID-0030",
            "CSAFPID-0032",
            "CSAFPID-0009",
            "CSAFPID-0025"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2024-1573",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability due to missing authentication for critical function exists in the mobile monitoring feature of the affected products when all of the following conditions are met: * Active Directory is used in the security setting. * \"Automatic log in\" option is enabled in the security setting. * The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account. * The IcoAnyGlass IIS Application Pool account is included in GENESIS64 and MC Works64 Security and has permission to log in. This vulnerability allows a remote unauthenticated attacker to bypass proper authentication and log in to the system.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:T/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0018",
          "CSAFPID-0021",
          "CSAFPID-0024",
          "CSAFPID-0027",
          "CSAFPID-0029",
          "CSAFPID-0032",
          "CSAFPID-0016",
          "CSAFPID-0033"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1573"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/306.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for IoTWorX. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx\". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0016"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.97.3 or later for IoTWorX. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0033"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "no_fix_planned",
          "details": "There are no plans to release a security update for Mitsubishi Electric MC Works64.  In the security settings of MC Works64, ensure that at least one of the following four conditions is not met: Active Directory is used in the security setting. \u201cAutomatic log in\u201d option is enabled in the security setting. The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONICS Suite and MC Works64 Security and has permission to log in.",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolate them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0032",
            "CSAFPID-0016",
            "CSAFPID-0033"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend restricting physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0032",
            "CSAFPID-0016",
            "CSAFPID-0033"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the user from clicking on web links in e-mails or other messages from untrusted sources, or from opening attachments in untrusted e-mails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0032",
            "CSAFPID-0016",
            "CSAFPID-0033"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend ensuring that at least one of the following four conditions in the security settings of GENESIS64, ICONICS Suite and MC Works64 is not met. (1) Active Directory is used in the security setting. (2) \"Automatic log in\"option is enabled in the security setting (3) The IcoAnyGlass IIS application pool is running under an Active Directory Domain Account. (4) The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONICS Suite and MC Works64 Security and has permission to log in.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0032",
            "CSAFPID-0016",
            "CSAFPID-0033"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0032",
            "CSAFPID-0016",
            "CSAFPID-0033"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2024-1574",
      "cwe": {
        "id": "CWE-470",
        "name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An arbitrary code execution vulnerability due to use of externally-controlled input to select classes or code (\u0027unsafe reflection\u0027) exists in the licensing feature of the affected products. This vulnerability allows a local attacker to execute an arbitrary code with administrative privileges by tampering with a specific file that is not protected by the system.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0018",
          "CSAFPID-0021",
          "CSAFPID-0024",
          "CSAFPID-0027",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1574"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/470.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at \"https://iconics.com/About/Security/CERT\".",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013"
          ],
          "url": "https://iconics.com/About/Security/CERT"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnaltitiX, and MobileHMI. Download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf\".",
          "product_ids": [
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf"
        },
        {
          "category": "no_fix_planned",
          "details": "For users of Mitsubishi Electric Iconics Digital Solutions GENESIS32 and BizViz: Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts. Restrict physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact. Do not click on web links in emails from untrusted sources. Also, do not open attachments in untrusted emails. ",
          "product_ids": [
            "CSAFPID-0014",
            "CSAFPID-0015"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "For users of Mitsubishi Electric GENESIS32, BizViz, and MC Works64: Locate control system networks and devices behind firewalls and isolate them from untrusted networks and hosts. Restrict physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact. Do not click on web links in emails from untrusted sources. Also, do not open attachments in untrusted emails.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0031",
            "CSAFPID-0032"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolate them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0030",
            "CSAFPID-0031",
            "CSAFPID-0032"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend restricting physical access to the personal computer where the product is installed and the network to which the personal computer is connected to prevent unauthorized contact, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0030",
            "CSAFPID-0031",
            "CSAFPID-0032"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend preventing the user from clicking on web links in e-mails or other messages from untrusted sources, or from opening attachments in untrusted e-mails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0030",
            "CSAFPID-0031",
            "CSAFPID-0032"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0011",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0018",
            "CSAFPID-0021",
            "CSAFPID-0024",
            "CSAFPID-0027",
            "CSAFPID-0029",
            "CSAFPID-0030",
            "CSAFPID-0031",
            "CSAFPID-0032"
          ]
        }
      ]
    }
  ]
}