Mitsubishi Electric GENESIS64 DCOM flaw can expose or destroy data
Original title: Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
An attacker logged in as the product administrator can run DCOM objects locally or remotely; fixed builds are 10.98 or later.
Incorrect privilege assignment in several Mitsubishi Electric and ICONICS industrial products lets someone who can log in with the products' administrator account launch and operate DCOM objects locally or remotely. Installers unnecessarily grant that account default DCOM permissions, enabling disclosure, tampering, destruction or deletion of internal information, or a denial of service. Version 10.98 or later is being released for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI; access restrictions are advised where no fix is available.
Unconfirmed: The notice does not name a CVE or confirm exploitation, and it does not fully state whether every titled product is fixed in 10.98.
- GENESIS64 and ICONICS Suite from 10.97 through 10.97.3 are listed as affected.
- GENESIS versions 11.03 and earlier are also marked known affected.
- The issue is CWE-266; the notice text does not name a CVE.
- Mitigations include administrator-only logon, firewall or VPN limits, and physical access control.
Impact: Disclose, tamper with, destroy or delete data, or cause DoS
| Product | Affected | Fixed in |
|---|---|---|
| Mitsubishi Electric GENESIS64 | >=10.97|<=10.97.2; <=10.97.3 | 10.98 or later |
| Mitsubishi Electric ICONICS Suite | >=10.97|<=10.97.2; <=10.97.3 | 10.98 or later |
| Mitsubishi Electric GENESIS | <=11.03 | — |
| Mitsubishi Electric Hyper Historian | — | 10.98 or later |
| Mitsubishi Electric AnalytiX | — | 10.98 or later |
| Mitsubishi Electric MobileHMI | — | 10.98 or later |
| Mitsubishi Electric MC Works64 | — | — |
- 1.Install version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI.
- 2.Allow only administrator logon and block remote login from untrusted networks and hosts.
- 3.Use a firewall or VPN and restrict physical access to affected PCs and networks.
From the original article
12 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.