CVE-2024-9852

Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/vu/JVNVU93891820
https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf

Configurations

No configuration.

History

06 Dec 2024, 06:15

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de elemento de ruta de búsqueda no controlada en ICONICS GENESIS64 en todas las versiones, Mitsubishi Electric GENESIS64 en todas las versiones y Mitsubishi Electric MC Works64 en todas las versiones permite que un atacante local autenticado ejecute un código malicioso almacenando una DLL especialmente manipulada en una carpeta específica. Esto podría provocar la divulgación, manipulación, destrucción o eliminación de información en los productos afectados, o provocar una condición de denegación de servicio (DoS) en los productos.
References		() https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04 -

28 Nov 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-28 23:15

Updated : 2024-12-06 06:15

NVD link : CVE-2024-9852

Mitre link : CVE-2024-9852

CVE.ORG link : CVE-2024-9852

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2024-9852", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-11-28T23:15:04.890", "references": [{"url": "https://jvn.jp/vu/JVNVU93891820", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}, {"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products."}, {"lang": "es", "value": "La vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada en ICONICS GENESIS64 en todas las versiones, Mitsubishi Electric GENESIS64 en todas las versiones y Mitsubishi Electric MC Works64 en todas las versiones permite que un atacante local autenticado ejecute un c\u00f3digo malicioso almacenando una DLL especialmente manipulada en una carpeta espec\u00edfica. Esto podr\u00eda provocar la divulgaci\u00f3n, manipulaci\u00f3n, destrucci\u00f3n o eliminaci\u00f3n de informaci\u00f3n en los productos afectados, o provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en los productos."}], "lastModified": "2024-12-06T06:15:23.200", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}