CVE-2022-23128

The CVE-2022-23128 entry describes an Incomplete List of Disallowed Inputs vulnerability affecting Mitsubishi Electric MC Works64 (versions 4.00A to 4.04E) and ICONICS GENESIS64, Hyper Historian, AnalytiX, and MobileHMI (versions 10.95.3 to 10.97). The root cause is a bypass of authentication via...

CVE-2022-23130

CVE-2022-23130 describes a Buffer Over-read in Mitsubishi Electric MC Works64 (v4.00A–4.04E) and related ICONICS GENESIS64/GENESIS32 products up to prior versions. The root cause is a memory allocation error in the SQL query engine that can crash the SQL Server, enabling DoS when a config file wi...

CVE-2021-27040

CVE-2021-27040 is an out-of-bounds read in the DWG file parsing path that affects ICONICS GENESIS64 (and related components) when importing DWG data. Root cause described across sources as improper validation of user-supplied data leading to reading past allocated buffers, enabling potential arbi...

CVE-2021-27041

CVE-2021-27041 affects Autodesk AutoCAD DWG file parsing. The flaw is an out-of-bounds write resulting from insufficient validation while parsing DWG data, allowing arbitrary code execution. Exploitation vectors involve opening a malicious DWG file (user interaction may be required per sources). ...

CVE-2020-12007

CVE-2020-12007 describes a deserialization vulnerability in ICONICS Genesis64/Genesis32 GenBroker components (FrameWorX server) that can enable remote code execution or a denial-of-service when processing specially crafted network packets. Affected products include GENESIS64 GenBroker64/FrameWorX...

CVE-2024-7587

CVE-2024-7587 describes an Incorrect Default Permissions vulnerability in GenBroker32, distributed with Mitsubishi Electric GENESIS64 (10.97.3 and prior), ICONICS Suite GENESIS64/ICONICS Suite (10.97.3 and prior), GENESIS32 (9.70.300.23 and prior), and MC Works64 (all versions). The root cause is...

CVE-2020-12011

CVE-2020-12011 affects ICONICS Genesis64/Genesis32 and Mitsubishi Electric MC Works64/MC Works32 families. The vulnerability is an out-of-bounds write in certain broker/server components that could be triggered by a specially crafted network packet, potentially causing denial of service or remote...

CVE-2020-12013

CVE-2020-12013 is a code-injection vulnerability affecting Mitsubishi Electric MC Works64 (4.02C and earlier) and MC Works32 (3.00A), as well as ICONICS GenBroker64/GenBroker32 components (FrameWorX/Platform Services/Workbench) up to the listed prior versions. The issue arises from a specially cr...

CVE-2020-12009

CVE-2020-12009 pertains to a deserialization vulnerability in ICONICS/Mitsubishi Electric MC Works64/MC Works32 components. A specially crafted network packet could trigger a denial-of-service condition in affected products: MC Works64 (versions up to 4.02C and prior, broker64), MC Works32 (3.00A...

CVE-2022-33317

The CVE-2022-33317 issue affects Mitsubishi Electric ICONICS GENESIS64 family and MC Works64: GENESIS64 (including ICONICS GENESIS64, ICONICS Digital Solutions GENESIS64) up to version 10.97.1 and MC Works64 up to 4.04E. Root cause: Inclusion of Functionality from Untrusted Control Sphere enables...

CVE-2022-23129

CVE-2022-23129 affects Mitsubishi Electric MC Works64 and ICONICS GENESIS64 where exporting GridWorX Server configuration to CSV saves authentication information in plaintext. Affected products: ICONICS GENESIS64 (versions 10.90 to 10.97) and MC Works64 (prior to 4.04E / 10.95.210.01). Root cause...

CVE-2022-33316

The CVE-2022-33316 issue affects Mitsubishi Electric GENESIS64 and ICONICS suites (GENESIS64, ICONICS Suite, ICONICS Digital Solutions ICONICS Suite) and MC Works64, with a root cause of Deserialization of Untrusted Data. Versions affected include GENESIS64 10.97–10.97.1 and MC Works64 <= 4.04...

CVE-2022-33319

CVE-2022-33319 is an out-of-bounds read affecting ICONICS GENESIS64 (versions up to 10.97.1, including GENESIS64 and related ICONICS Suite components) and Mitsubishi Electric MC Works64 (up to 4.04E). The vulnerability allows a remote unauthenticated attacker to disclose memory contents or cause ...

CVE-2020-12015

CVE-2020-12015 is a deserialization of untrusted data vulnerability affecting Mitsubishi Electric MC Works64 (4.02C and earlier) and MC Works32 (3.00A), plus ICONICS GENESIS64/GENESIS32 components (GenBroker64/Platform Services/Workbench/FrameWorX Server v10.96 and earlier; GenBroker32 v9.5 and e...

CVE-2022-40264

ICONICS/Mitsubishi Electric GENESIS64 (versions 10.96–10.97.2) contains a Path Traversal in PKGX file parsing that can let an unauthenticated attacker cause the target system to create, tamper with, or destroy arbitrary files by persuading a legitimate user to import a crafted project package. Ro...

CVE-2022-33315

The CVE-2022-33315 issue is a deserialization vulnerability in Mitsubishi Electric GENESIS64 (including ICONICS GENESIS64, ICONICS Suite, and MC Works64) affecting 10.97–10.97.1 for GENESIS64/ICONICS Suite and 4.04E (10.95.210.01) and earlier for MC Works64. The root cause is deserialization of u...

CVE-2022-29834

Summary: CVE-2022-29834 is a path traversal vulnerability in ICONICS GENESIS64 and related ICONICS/Mitsubishi Electric products (versions 10.97 to 10.97.1) that allows a remote, unauthenticated attacker to access arbitrary files on the GENESIS64 or ICONICS Suite servers by embedding a crafted URL...

CVE-2022-33318

CVE-2022-33318 affects ICONICS GENESIS64 and related MC Works64 products. The issue is Deserialization of Untrusted Data that, per Red Hat/PRION and CISA docs, could allow a remote unauthenticated attacker to execute arbitrary code by sending specially crafted packets to GENESIS64/MC Works64 serv...

CVE-2022-33320

ICONICS GENESIS64 family and related MC Works64 products are affected by a Deserialization of Untrusted Data vulnerability (CVE-2022-33320). The issue exists when a user loads a project configuration file containing malicious XML, enabling an unauthenticated attacker to execute arbitrary code via...