Loading story…
CISA updated advisories for Mitsubishi Electric Iconics Digital Solutions and related Mitsubishi products after disclosure of a high-severity malicious code execution vulnerability in the Phone agent used by the multi-agent notification feature. The flaw is an uncontrolled search path element issue tracked as CWE-427 and affects GENESIS64, ICONICS Suite, MC Works64, GENESIS32, and Hyper Historian. According to the advisory, all versions of MC Works64 and GENESIS32 are impacted, while GENESIS64, ICONICS Suite, and Hyper Historian are affected through version 10.97.3; CISA also referenced related updates covering Mitsubishi HMI/SCADA deployments.
Exposure depends on whether the multi-agent notification feature and Phone agent are installed and, in some cases, whether a Dialogic telephony board driver is present. Mitsubishi said a fix is available in version 10.98 or later for some environments that do not require the Phone agent, but no fix is planned for MC Works64, GENESIS32, or certain Phone agent use cases. CISA and Mitsubishi recommended removing the multi-agent notification feature if it is not needed, avoiding Phone agent installation during custom setup, installing the Dialogic driver where applicable, and tightening network segmentation, remote access, email handling, and physical access controls. The vulnerability carries a CVSS v3.1 score of 7.8.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
On April 7, 2026, CISA published updated versions of advisories ICSA-24-184-03 and ICSA-24-338-04, reflecting continued maintenance of guidance for the Mitsubishi Electric and ICONICS vulnerabilities. The updates indicate the advisories remained active and were revised after their original publication.
Mitsubishi stated that version 10.98 or later fixes the issue for some GENESIS64, ICONICS Suite, and Hyper Historian users who do not require the Phone agent. It also said no fix is planned for MC Works64, GENESIS32, or certain Phone agent use cases, recommending uninstalling or avoiding the vulnerable feature and applying compensating controls.
Mitsubishi Electric released PSIRT advisory 2025-018 for the vulnerability affecting its products and Mitsubishi Electric Iconics Digital Solutions software. The vendor advisory documented impacted products and remediation or mitigation guidance.
CISA disclosed a high-severity uncontrolled search path vulnerability affecting the Phone agent in Mitsubishi Electric and ICONICS products including GENESIS64, ICONICS Suite, MC Works64, GENESIS32, and Hyper Historian. The advisory described affected versions, exploitation conditions, and mitigations.
CISA published advisory ICSA-24-184-03 concerning Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric products. The advisory was later updated, indicating continued tracking of the affected products and vulnerabilities.
CISA issued advisory ICSA-22-020-01 covering Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric HMI SCADA products. This marks the earliest referenced public disclosure in the provided materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed multiple vulnerabilities affecting **ICONICS Suite**, **GENESIS64**, **GENESIS32**, **MC Works64**, and related products used in industrial and manufacturing environments. CISA said the flaws include **deserialization-based remote code execution**, **path traversal**, inclusion of functionality from an untrusted control sphere, and an **out-of-bounds read** that could lead to information disclosure or denial of service. The most severe issue carries a **CVSS v3.1 score of 9.8**, and affected versions include GENESIS64 and ICONICS Suite `10.97` through `10.97.1`, **MC Works64** up to `4.04E`, and **GENESIS32** up to `9.7`. A separate updated advisory also detailed an **information tampering** flaw caused by execution with unnecessary privileges across additional ICONICS-related products, including **MobileHMI**, **Hyper Historian**, **AnalytiX**, **IoTWorX**, **GENESIS**, and **BizViz**. CISA said a low-privileged local attacker could create a symbolic link and abuse service file writes to overwrite arbitrary files, potentially destroying files and causing denial of service, a weakness tracked under **CWE-250** and rated **CVSS 6.5**. Vendor fixes are available for several current product lines, including version `10.98` or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version `10.96` or later for IoTWorX, and version `11.01` or later for GENESIS, while no fixes are planned for some legacy products such as **MC Works64**, **GENESIS32**, and **BizViz**; operators are urged to isolate affected systems, restrict remote and physical access, and use firewalls or VPNs.
Jun 29, 2026
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed a high-severity vulnerability affecting multiple **GENESIS64**, **ICONICS Suite**, **MobileHMI**, **Hyper Historian**, **AnalytiX**, **GENESIS**, and **MC Works 64** products. The flaw, tracked as **CWE-312** for cleartext storage of sensitive information, occurs when local caching with SQLite is enabled and SQL authentication is used, causing SQL Server credentials to be stored in plaintext in local cache files. CISA said the issue could allow information disclosure and could also enable tampering or denial-of-service conditions; the advisory assigned the vulnerability a **CVSS v3.1 score of 8.8**. Mitsubishi Electric released fixes in **version 10.98 or later** for several affected product lines and **version 11.03 or later** for GENESIS, while **no fix is planned for MC Works 64**. CISA and the vendor urged operators to disable local cache where possible, delete cached database files, use **Windows authentication** instead of SQL authentication, and reduce exposure by restricting administrative and remote access, segmenting affected systems on internal networks, and limiting physical and network access to industrial control environments.
Jun 29, 2026
Palo Alto Networks Unit 42 reported **CVE-2025-0921**, a **medium-severity (CVSS 6.5)** vulnerability in *Mitsubishi Electric Iconics Digital Solutions GENESIS64 (Iconics Suite)* affecting Windows deployments **10.97.2 and earlier**. The issue involves **unnecessary privileges** across multiple services, enabling misuse of privileged file system operations that could **corrupt critical binaries** and lead to **integrity/availability impact**, including a potential **denial-of-service (DoS)** condition; Unit 42 coordinated disclosure with Iconics, and the vendor published mitigations/workarounds intended to address the reported issues. Separately, reporting highlighted a CISA warning on **CVE-2025-26385**, a **critical (CVSS 10.0)** vulnerability in *Johnson Controls Metasys* building automation components (including **ADS/ADX**, **SCT**, **CCT**, and certain **NAE/LCS engines** across specified version ranges). The flaw is described as a **remote SQL injection / remote SQL execution** condition that could allow unauthorized SQL command execution, potentially enabling **alteration or loss of data** used to manage building environments; Johnson Controls and CISA recommended applying the vendor patch (e.g., **GIV-165989** via the License Portal) and following compensating controls where patching is not immediately possible.
Jun 29, 2026