VulnSocial

CVE-2024-7587Disclosure(iconics / genesis64)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch iconics genesis64 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

iconics CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-276

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • genesis64
  • mc_works64

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
iconicsmitsubishielectric
Products
genesis64mc_works64

1 version affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-01-31: 1Patch / Workaround · 2026-01-31: 1Technical Details · 2026-01-31: 101-31
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • ThreatSynop@ThreatSynop
    Disclosure

    🚨 Unit 42 Details CVE-2025-0921 in ICONICS/GENESIS64: Privileged File Ops Can Brick SCADA Hosts Unit 42 analyzed CVE-2025-0921 (CVSS 6.5) in Mitsubishi Electric ICONICS Suite/GENESIS64 where a privileged Pager Agent workflow can be abused to perform unsafe file-system operations; when chained with the GenBroker32 installer flaw (CVE-2024-7587) that makes critical configs writable, a low-priv user can redirect logging to overwrite/corrupt binaries and trigger DoS, impacting OT availability/integrity. Apply the vendor advisory/workaround and update vulnerable ICONICS Suite versions (Windows 10.97.2 and earlier) to remove the exposure. 🎯 Target: Global/Industrial OT (SCADA) #️⃣ Category: #Vulnerability #BlueTeam #CyberIntel 🔗 URL: https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/

    Post summary

    Unit 42 discloses CVE‑2025‑0921 in ICONICS Suite/GENESIS64, detailing privileged file‑system operations that can trigger a DoS when chained with CVE‑2024‑7587, and urges users to apply the vendor advisory and update to newer versions.

    0000093
    196 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appiconicsgenesis64---
Appmitsubishielectricmc_works64---

Explore more

Back to dashboardiconics CVEsmitsubishielectric CVEsgenesis64 vulnerabilities