Information Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32

Vulnerability

Incorrect default permissions (CWE-276) exist on the C:\ProgramData\ICONICS folder when the GenBroker32 component, bundled with the installers for Mitsubishi Electric GENESIS64, ICONICS Suite, MC Works64, and GENESIS32, is installed on the same PC. Affected versions include GENESIS64 and ICONICS Suite up to version 10.97.3, GENESIS32 up to version 9.70.300.23, and all versions of MC Works64. [1][2]

Exploitation

A local authenticated attacker can access the C:\ProgramData\ICONICS folder due to its incorrect permissions. No additional privileges beyond local access are required. The attacker can read, modify, or delete files within this folder, potentially causing a denial of service by corrupting critical data. [1]

Impact

Successful exploitation allows the attacker to disclose confidential information, tamper with data, or cause a denial of service (DoS) condition on the affected products. The attacker gains access at the privilege level of the local user account used to access the folder. [2]

Mitigation

For GENESIS64 and ICONICS Suite version 10.97.3 users, apply the security update from the ICONICS Community Portal after uninstalling GenBroker32 and reinstalling it [1]. For GENESIS32 and MC Works64, no fixes are planned; GENESIS32 has reached end-of-life, and MC Works64 users should follow the advisory [2]. No workaround has been provided for unfixed versions.