CVE-2024-1182 in ICONICS
Summary
by MITRE • 07/04/2024
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/08/2026
The vulnerability identified as CVE-2024-1182 represents a critical uncontrolled search path element flaw affecting multiple Mitsubishi Electric industrial software products including GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 across various versions. This weakness stems from improper handling of dynamic library loading mechanisms within the alarm multi-agent notification feature, specifically when the Pager agent component is enabled. The vulnerability creates a path traversal risk where malicious actors can manipulate the software's library search order by placing specially crafted dynamic link libraries in predetermined directories. This issue falls under CWE-427 Uncontrolled Search Path Element, which directly relates to the improper handling of library paths in software applications. The attack vector requires local system access and leverages the legitimate software installation process to execute arbitrary code, making it particularly dangerous in industrial control environments where software integrity is paramount.
The technical implementation of this vulnerability exploits the software's default search path behavior where the system prioritizes certain directories over others when loading dynamic libraries. When the Pager agent component is active, the software's runtime environment does not properly validate or sanitize the library loading sequence, allowing attackers to place malicious DLL files in locations that are searched before legitimate system libraries. This creates a classic DLL hijacking scenario where the system loads the attacker-controlled library instead of the intended legitimate one. The vulnerability specifically impacts installations where the alarm multi-agent notification feature is enabled, making it particularly relevant for industrial automation and monitoring systems that rely heavily on notification mechanisms. The attack requires local access to the system, typically through legitimate user credentials or compromised accounts, but once executed can provide full code execution privileges with the same privileges as the targeted application.
The operational impact of CVE-2024-1182 extends beyond simple code execution, potentially compromising entire industrial control systems that depend on these Mitsubishi Electric products. In industrial environments, the affected software often controls critical processes and data flow, making this vulnerability particularly dangerous for operational technology infrastructure. The attack could lead to unauthorized system modifications, data corruption, or complete system compromise, especially when these applications run with elevated privileges. The vulnerability affects multiple generations of Mitsubishi Electric software, indicating a systemic issue in how these products handle library loading across their product portfolio. This widespread impact suggests that organizations using any of these versions may be vulnerable, creating a significant risk exposure for industrial facilities, manufacturing plants, and process control systems that rely on these platforms for their operations. The ATT&CK framework categorizes this vulnerability under T1059 Command and Scripting Interpreter and T1546 Software Replacement, as it enables attackers to replace legitimate software components with malicious ones through the compromised library loading mechanism.
Organizations should immediately implement mitigations including updating to the latest available versions of affected software products, which typically include proper library path validation and secure loading mechanisms. System administrators should also implement strict access controls and monitor for unauthorized DLL placements in system directories, particularly those related to the affected software installations. The implementation of application whitelisting policies can prevent execution of unauthorized DLL files, while regular security audits should verify that only legitimate libraries are present in the software search paths. Additionally, network segmentation and privilege separation should be enforced to limit the potential impact of successful exploitation, as the vulnerability requires local system access but could provide elevated privileges once executed. Organizations should also consider implementing behavioral monitoring solutions that can detect anomalous DLL loading patterns or unauthorized library modifications, which would help identify potential exploitation attempts before they can cause significant damage to industrial control systems.