Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.

Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64 and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.

When the BACnet Secure Connect feature is enabled in the affected products, a temporary denial-of-service vulnerability due to allocation of resources without limits or throttling exists in the OpenSSL library integrated into the products, during data validation. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending a certificate that contains a specially crafted ANS 1 OBJECT IDENTIFIER. When running on X86_64 CPUs supporting AVX512-IFMA instructions and the BACnet Secure Connect feature is enabled in the affected products, a denial-of-service vulnerability due to improper verification of cryptographic signature exists in the Message Authentication Code (MAC) implementation in OpenSSL library integrated into the products. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending messages that contain specially crafted Message Authentication Code (MAC). When the affected products are installed with the Pager agent in the multi-agent notification feature, an arbitrary code execution vulnerability due to uncontrolled search path element exists in the feature. This vulnerability allows a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder. An authentication bypass vulnerability due to missing authentication for critical function exists in the mobile monitoring feature of the affected products when all of the…