Mitsubishi Electric flaws span code execution and access bypass
CISA lists four vulnerabilities affecting ten Mitsubishi Electric software suites, with outcomes ranging from arbitrary code execution to authentication bypass and denial of service.
CVE-2023-4863 can enable arbitrary code execution in GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2. The other three flaws affect product-specific subsets: two can let an attacker bypass authentication, while another permits arbitrary operations. CISA says exploitation could expose, alter, destroy, or delete information, or make a system unavailable.
CISA identifies critical manufacturing as a sector where these products are deployed worldwide. Its excerpt names version 10.97.3 or later for GENESIS64 and ICONICS Suite, but does not map fixes across the rest of the affected products. A plant using another listed suite therefore cannot infer its remediation status from that version alone.
CVSS 8.8 HIGH: heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. EPSS 100% (100th percentile).
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz | CISA
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication…