{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2024-1574",
        "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "state": "PUBLISHED",
        "assignerShortName": "Mitsubishi",
        "dateReserved": "2024-02-16T01:30:45.960Z",
        "datePublished": "2024-07-04T09:02:35.260Z",
        "dateUpdated": "2024-08-01T18:40:21.447Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "product": "GENESIS64",
                    "vendor": "ICONICS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "versions 10.97 to 10.97.2"
                        }
                    ]
                },
                {
                    "defaultStatus": "unaffected",
                    "product": "GENESIS64",
                    "vendor": "Mitsubishi Electric Corporation",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "versions 10.97 to 10.97.2"
                        }
                    ]
                },
                {
                    "defaultStatus": "unaffected",
                    "product": "MC Works64",
                    "vendor": "Mitsubishi Electric Corporation",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "all versions"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system."
                        }
                    ],
                    "value": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of ICONICS GENESIS64 versions 10.97 to 10.97.2, Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.2 and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code with administrative privileges by tampering with a specific file that is not protected by the system."
                }
            ],
            "impacts": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "Malicious Code Execution"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "HIGH",
                        "attackVector": "LOCAL",
                        "availabilityImpact": "HIGH",
                        "baseScore": 6.7,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "userInteraction": "REQUIRED",
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-470",
                            "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
                "shortName": "Mitsubishi",
                "dateUpdated": "2024-07-04T09:02:35.260Z"
            },
            "references": [
                {
                    "tags": [
                        "vendor-advisory"
                    ],
                    "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf"
                },
                {
                    "tags": [
                        "government-resource"
                    ],
                    "url": "https://jvn.jp/vu/JVNVU98894016/"
                },
                {
                    "tags": [
                        "government-resource"
                    ],
                    "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03"
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 0.1.0-dev"
            }
        },
        "adp": [
            {
                "affected": [
                    {
                        "vendor": "iconics",
                        "product": "genesis64",
                        "cpes": [
                            "cpe:2.3:a:iconics:genesis64:10.97:*:*:*:*:*:*:*"
                        ],
                        "defaultStatus": "unaffected",
                        "versions": [
                            {
                                "version": "10.97",
                                "status": "affected",
                                "lessThan": "10.97.92",
                                "versionType": "custom"
                            }
                        ]
                    },
                    {
                        "vendor": "mitsubishielectric",
                        "product": "mc_works64",
                        "cpes": [
                            "cpe:2.3:a:mitsubishielectric:mc_works64:-:*:*:*:*:*:*:*"
                        ],
                        "defaultStatus": "unaffected",
                        "versions": [
                            {
                                "version": "0",
                                "status": "affected",
                                "lessThanOrEqual": "*",
                                "versionType": "custom"
                            }
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2024-07-05T14:44:19.238774Z",
                                "id": "CVE-2024-1574",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-07-05T14:45:36.502Z"
                }
            },
            {
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2024-08-01T18:40:21.447Z"
                },
                "title": "CVE Program Container",
                "references": [
                    {
                        "tags": [
                            "vendor-advisory",
                            "x_transferred"
                        ],
                        "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-004_en.pdf"
                    },
                    {
                        "tags": [
                            "government-resource",
                            "x_transferred"
                        ],
                        "url": "https://jvn.jp/vu/JVNVU98894016/"
                    },
                    {
                        "tags": [
                            "government-resource",
                            "x_transferred"
                        ],
                        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-03"
                    }
                ]
            }
        ]
    }
}