CVE-2024-1574 
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric AnalytiX versions 10.97.2 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric BizViz versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric Iconics Digital Solutions BizViz versions 9.7 and prior allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system.
Problem types: cwe_id: CWE-470
description: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: Mitsubishi Electric Iconics Digital Solutions
product: GENESIS64
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GENESIS64
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: ICONICS Suite
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: ICONICS Suite
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: Hyper Historian
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: Hyper Historian
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: AnalytiX
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AnalytiX
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: MobileHMI
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MobileHMI
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: GENESIS32
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GENESIS32
default_status: unaffected
vendor: Mitsubishi Electric Iconics Digital Solutions
product: BizViz
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: BizViz
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MC Works64
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: 2024-07-04T09:02:35.260Z