Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or to cause a denial of service (DoS) condition on the products.

Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.

A malicious code execution vulnerability due to an uncontrolled search path element exists in the Phone agent of the multi-agent notification feature of GENESIS64, ICONICS Suite, MC Works64, and GENESIS32. Customers using a Dialogic telephony board without installing the Dialogic driver, or non-Dialogic telephony board, and using any version of MC Works64 or GENESIS32, or version 10.97.2 or prior of GENESIS64 or ICONICS Suite are unconditionally affected. In addition, version 10.97.3 or later of GENESIS64 or ICONICS Suite and installing multi-agent notification feature are affected. A malicious code execution vulnerability due to dead code exists in the FA device communication driver of GENESIS64 and ICONICS Suite. Users who install affected products in an unprotected folder other than the default installation folder are affected. A malicious code execution vulnerability due to an uncontrolled search path element exists in the FAX agent of the multi-agent notification feature on GENESIS64, ICONICS Suite, MC Works64, and GENESIS32. Users of any version of MC Works64 or GENESIS32, or version 10.97.2 or prior of GENESIS64 or ICONICS Suite are unconditionally affected. In addition, users of version 10.97.3 or later of GENESIS64 or ICONICS Suite and installing multi-agent notification feature are affected.