CVE-2024-7587

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7587
Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://jvn.jp/vu/JVNVU95548104 Mitigation Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01 Third Party Advisory US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*
cpe:2.3:a:mitsubishielectric:mc_works64:-:*:*:*:*:*:*:*
History

09 Jan 2026, 06:16

Type Values Removed Values Added
Summary (en) Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for ICONICS GENESIS64 version 10.97.3 and prior, Mitsubishi Electric GENESIS64 version 10.97.3 and prior and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64 or MC Works64. (en) Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

05 Nov 2024, 17:24

Type Values Removed Values Added
CPE cpe:2.3:a:mitsubishielectric:mc_works64:-:*:*:*:*:*:*:*
cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*
First Time Iconics genesis64
Iconics
Mitsubishielectric mc Works64
Mitsubishielectric
References () https://jvn.jp/vu/JVNVU95548104 - () https://jvn.jp/vu/JVNVU95548104 - Mitigation, Third Party Advisory
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01 - Third Party Advisory, US Government Resource
References () https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf - () https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf - Vendor Advisory

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de permisos predeterminados incorrectos en GenBroker32, que está incluido en los instaladores de ICONICS GENESIS64 versión 10.97.3 y anteriores, Mitsubishi Electric GENESIS64 versión 10.97.3 y anteriores y Mitsubishi Electric MC Works64 todas las versiones, permite a un atacante autenticado local divulgar o alterar información y datos confidenciales contenidos en los productos, o causar una condición de denegación de servicio (DoS) en los productos, al acceder a una carpeta con permisos incorrectos, cuando GenBroker32 está instalado en la misma PC que GENESIS64 o MC Works64.

22 Oct 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-22 23:15

Updated : 2026-01-09 06:16

NVD link : CVE-2024-7587

Mitre link : CVE-2024-7587

CVE.ORG link : CVE-2024-7587

JSON object : View

Products Affected

mitsubishielectric

  • mc_works64

iconics

  • genesis64
CWE
CWE-276

Incorrect Default Permissions