CISA Alerts on Multiple Critical Vulnerabilities in Mitsubishi Electric SCADA Software
CISA has issued a critical advisory detailing several vulnerabilities across multiple Mitsubishi Electric industrial control system products, including GENESIS64 and ICONICS Suite, potentially allowing for arbitrary code execution and authentication bypass.
CISA has issued a significant advisory highlighting multiple vulnerabilities affecting a range of Mitsubishi Electric industrial control system (ICS) products. The affected software includes widely deployed solutions such as GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. These vulnerabilities, if successfully exploited, could lead to severe consequences including arbitrary code execution, authentication bypass, information disclosure, data tampering or destruction, and denial-of-service conditions.
The advisory specifically calls out CVE-2023-4863, an out-of-bounds write vulnerability stemming from the use of the libwebp component within GENESIS64 and ICONICS Suite. This flaw could allow an authenticated local attacker to achieve arbitrary code execution by importing a specially crafted file. The impact of this vulnerability extends to potential disclosure, modification, or deletion of internal information, as well as system instability.
Further compounding the risk are CVE-2026-16436, CVE-2026-16437, and CVE-2026-16438. These vulnerabilities collectively enable attackers to bypass authentication mechanisms and perform arbitrary operations on affected systems. Successful exploitation of these could grant unauthorized access and control, leading to significant disruption and data compromise.
Several versions of Mitsubishi Electric's products are impacted. For CVE-2023-4863, affected versions of GENESIS64 and ICONICS Suite are noted as versions 10.97 through 10.97.2. For the authentication bypass and arbitrary operation vulnerabilities (CVE-2026-16436 through CVE-2026-16438), the affected versions are more extensive, including GENESIS up to 11.03, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI up to 10.97.3, and specific versions of IoTWorX, MC Works64, GENESIS32, and BizViz.
Mitsubishi Electric has released vendor fixes, with version 10.97.3 or later available for GENESIS64 and ICONICS Suite. Users are strongly advised to download and install these updates from the provided links. The company also offers a detailed security advisory for further information.
For organizations unable to immediately apply the patches, Mitsubishi Electric and ICONICS Digital Solutions have outlined several mitigation strategies. These include restricting system access to administrators only, implementing network segmentation by blocking remote logins from untrusted networks, utilizing firewalls and VPNs for secure remote access, and restricting physical access to affected systems. Additionally, users are advised to practice safe browsing habits, such as avoiding suspicious links and email attachments, and to ensure anti-virus software is installed and up-to-date.
The CVSS score for the vulnerabilities is rated at 9.1, underscoring their critical severity. These vulnerabilities affect products deployed globally across critical infrastructure sectors, particularly in critical manufacturing. The widespread use of these SCADA systems means that a successful exploit could have far-reaching consequences for industrial operations and national security.
This advisory serves as a crucial reminder of the ongoing threats to operational technology (OT) environments. The complexity and interconnectedness of modern ICS solutions mean that vulnerabilities in one component can have cascading effects, emphasizing the need for continuous vigilance, prompt patching, and robust security practices within industrial control systems.