Loading story…
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed multiple vulnerabilities affecting ICONICS Suite, GENESIS64, GENESIS32, MC Works64, and related products used in industrial and manufacturing environments. CISA said the flaws include deserialization-based remote code execution, path traversal, inclusion of functionality from an untrusted control sphere, and an out-of-bounds read that could lead to information disclosure or denial of service. The most severe issue carries a CVSS v3.1 score of 9.8, and affected versions include GENESIS64 and ICONICS Suite 10.97 through 10.97.1, MC Works64 up to 4.04E, and GENESIS32 up to 9.7.
A separate updated advisory also detailed an information tampering flaw caused by execution with unnecessary privileges across additional ICONICS-related products, including MobileHMI, Hyper Historian, AnalytiX, IoTWorX, GENESIS, and BizViz. CISA said a low-privileged local attacker could create a symbolic link and abuse service file writes to overwrite arbitrary files, potentially destroying files and causing denial of service, a weakness tracked under CWE-250 and rated CVSS 6.5. Vendor fixes are available for several current product lines, including version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version 10.96 or later for IoTWorX, and version 11.01 or later for GENESIS, while no fixes are planned for some legacy products such as MC Works64, GENESIS32, and BizViz; operators are urged to isolate affected systems, restrict remote and physical access, and use firewalls or VPNs.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Vendor fixes were available for several current products, including version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version 10.96 or later for IoTWorX, and version 11.01 or later for GENESIS. No fixes were planned for some legacy products such as MC Works64, GENESIS32, and BizViz, with mitigations recommended instead.
CISA published Update F for an information tampering vulnerability caused by execution with unnecessary privileges in multiple ICONICS-related products, including GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz. The flaw allows a low-privileged local attacker to abuse symbolic links and service file writes to perform unauthorized writes to arbitrary files, potentially causing denial of service.
Vendor fixes were made available for GENESIS64 and ICONICS Suite through ICONICS critical rollups, while Mitsubishi Electric said no security updates were planned for legacy MC Works64 and GENESIS32 products. Recommended mitigations included network isolation, firewalling, minimizing internet exposure, and avoiding untrusted links or attachments.
Mitsubishi Electric published an advisory covering multiple vulnerabilities in ICONICS Suite, GENESIS64, GENESIS32, and MC Works64, including path traversal, deserialization-based remote code execution, untrusted control sphere functionality, and an out-of-bounds read. The affected products were described as used in critical manufacturing environments worldwide, with the most severe issue rated CVSS 9.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA updated advisories for **Mitsubishi Electric Iconics Digital Solutions** and related Mitsubishi products after disclosure of a high-severity malicious code execution vulnerability in the **Phone agent** used by the multi-agent notification feature. The flaw is an **uncontrolled search path element** issue tracked as **`CWE-427`** and affects **GENESIS64**, **ICONICS Suite**, **MC Works64**, **GENESIS32**, and **Hyper Historian**. According to the advisory, all versions of **MC Works64** and **GENESIS32** are impacted, while **GENESIS64**, **ICONICS Suite**, and **Hyper Historian** are affected through version **10.97.3**; CISA also referenced related updates covering Mitsubishi HMI/SCADA deployments. Exposure depends on whether the multi-agent notification feature and **Phone agent** are installed and, in some cases, whether a **Dialogic telephony board driver** is present. Mitsubishi said a fix is available in version **10.98** or later for some environments that do not require the Phone agent, but no fix is planned for **MC Works64**, **GENESIS32**, or certain Phone agent use cases. CISA and Mitsubishi recommended removing the multi-agent notification feature if it is not needed, avoiding Phone agent installation during custom setup, installing the Dialogic driver where applicable, and tightening network segmentation, remote access, email handling, and physical access controls. The vulnerability carries a **CVSS v3.1 score of 7.8**.
Jun 29, 2026
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed a high-severity vulnerability affecting multiple **GENESIS64**, **ICONICS Suite**, **MobileHMI**, **Hyper Historian**, **AnalytiX**, **GENESIS**, and **MC Works 64** products. The flaw, tracked as **CWE-312** for cleartext storage of sensitive information, occurs when local caching with SQLite is enabled and SQL authentication is used, causing SQL Server credentials to be stored in plaintext in local cache files. CISA said the issue could allow information disclosure and could also enable tampering or denial-of-service conditions; the advisory assigned the vulnerability a **CVSS v3.1 score of 8.8**. Mitsubishi Electric released fixes in **version 10.98 or later** for several affected product lines and **version 11.03 or later** for GENESIS, while **no fix is planned for MC Works 64**. CISA and the vendor urged operators to disable local cache where possible, delete cached database files, use **Windows authentication** instead of SQL authentication, and reduce exposure by restricting administrative and remote access, segmenting affected systems on internal networks, and limiting physical and network access to industrial control environments.
Jun 29, 2026
Palo Alto Networks Unit 42 reported **CVE-2025-0921**, a **medium-severity (CVSS 6.5)** vulnerability in *Mitsubishi Electric Iconics Digital Solutions GENESIS64 (Iconics Suite)* affecting Windows deployments **10.97.2 and earlier**. The issue involves **unnecessary privileges** across multiple services, enabling misuse of privileged file system operations that could **corrupt critical binaries** and lead to **integrity/availability impact**, including a potential **denial-of-service (DoS)** condition; Unit 42 coordinated disclosure with Iconics, and the vendor published mitigations/workarounds intended to address the reported issues. Separately, reporting highlighted a CISA warning on **CVE-2025-26385**, a **critical (CVSS 10.0)** vulnerability in *Johnson Controls Metasys* building automation components (including **ADS/ADX**, **SCT**, **CCT**, and certain **NAE/LCS engines** across specified version ranges). The flaw is described as a **remote SQL injection / remote SQL execution** condition that could allow unauthorized SQL command execution, potentially enabling **alteration or loss of data** used to manage building environments; Johnson Controls and CISA recommended applying the vendor patch (e.g., **GIV-165989** via the License Portal) and following compensating controls where patching is not immediately possible.
Jun 29, 2026