CVE-2024-7587

Estado: ModificadaAlta (7.8)—

Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.19%
Percentil entre todas las CVEs puntuadas: 8
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1222 File and Directory Permissions Modificationdefense impairment90 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact80 %

Acceso local autenticado (AV:L, PR:L) sin interacción permite escalar permisos sobre carpetas mal configuradas. CWE-276 (permisos por defecto incorrectos) confirma explotación de permisos. Los impactos incluyen lectura/manipulación de datos y DoS.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory Permissions Threat Intelligence Program Privileged Account Management Remote Data Storage Filter Network Traffic Execution Prevention

Tecnologías afectadas (2)

Iconics — Genesis64 Mitsubishielectric — MC Works64

CWE

CWE-276

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-7587",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7587",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T14:15:49.960141Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "GENESIS64",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97.3 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "MC Works64",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "product": "GENESIS64",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97.3 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "ICONICS Suite",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97.3 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "product": "ICONICS Suite",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 10.97.3 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "GENESIS32",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.70.300.23 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Iconics Digital Solutions",
          "product": "GENESIS32",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 9.70.300.23 and prior"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*"
          ],
          "vendor": "iconics",
          "product": "genesis64",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "10.97.3"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mitsubishielectric",
          "product": "mc_works64",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-22T23:15:02.367",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU95548104",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de permisos predeterminados incorrectos en GenBroker32, que está incluido en los instaladores de ICONICS GENESIS64 versión 10.97.3 y anteriores, Mitsubishi Electric GENESIS64 versión 10.97.3 y anteriores y Mitsubishi Electric MC Works64 todas las versiones, permite a un atacante autenticado local divulgar o alterar información y datos confidenciales contenidos en los productos, o causar una condición de denegación de servicio (DoS) en los productos, al acceder a una carpeta con permisos incorrectos, cuando GenBroker32 está instalado en la misma PC que GENESIS64 o MC Works64."
    }
  ],
  "lastModified": "2026-06-17T08:20:30.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "465895CD-DC88-425E-AC1B-03A877C38DB9",
              "versionEndIncluding": "10.97.3"
            },
            {
              "criteria": "cpe:2.3:a:mitsubishielectric:mc_works64:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D4E5637-94D7-4671-A581-7D27649CEDE3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}