← Vulnerability feed

Vulnerability record · CVE-2024-7587 · published 22 October 2024

CVE-2024-7587: Iconics genesis64 incorrect default permissions vulnerability

Iconics · Genesis64

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

7.8 CVSS 3.1 High EPSS 0.19% · top 92.1% CWE-276 · Incorrect default permissions
7.8CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU95548104 MitigationThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01 Third Party AdvisoryUS Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf Vendor Advisory

Track CVE-2024-7587 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-6943Mitsubishielectric ezsocket vulnerabilityUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions…EPSS 2.1%9.8CVE-2022-33318Mitsubishi Electric GENESIS64 and MC Works64 deserialization RCEGENESIS64, ICONICS Suite, GENESIS32 and MC Works64 contain a deserialization of untrusted data flaw (CWE-502). A remote attacker can send specially c…EPSS 48%analysed9.8CVE-2022-23128Iconics analytix vulnerabilityIncomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS G…EPSS 2.9%9.8CVE-2020-12007Mitsubishielectric mc works deserialization of untrusted data vulnerabilityA specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a de…EPSS 3.9%9.8CVE-2020-12011Mitsubishielectric mc works out-of-bounds write vulnerabilityA specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This …EPSS 29%9.1CVE-2022-33319Iconics genesis64 out-of-bounds read vulnerabilityOut-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 …EPSS 1.6%9.1CVE-2020-12013Mitsubishielectric mc works32 code injection vulnerabilityA specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi El…EPSS 3.0%7.8CVE-2022-33315Iconics genesis64 deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solut…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2024-7587), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.