This vulnerability (CVE-2024-1573) affects multiple Mitsubishi Electric Iconics Digital Solutions products including GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64, all at or below version 10.97.2 (10.95 for IoTWorX). It is classified as CWE-306: Missing Authentication for Critical Function. The issue allows a remote attacker to bypass authentication and log in without credentials if four conditions are met: Active Directory is used in security settings, the 'Automatic log in' option is enabled, the IcoAnyGlass IIS Application Pool runs under an Active Directory Domain Account, and that account is authorized to log in within the affected software. The CVSS v3.1 base score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls and log in to the affected system, potentially enabling unauthorized actions that impact system integrity. Confidentiality and availability impacts are not indicated. The vulnerability depends on specific configuration settings involving Active Directory and IIS Application Pool accounts, limiting its exploitability to environments with these conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and consider disabling the 'Automatic log in' option in security settings, avoid running the IcoAnyGlass IIS Application Pool under an Active Directory Domain Account with login permissions, or restrict such permissions to mitigate risk. Monitor vendor communications for patch releases or official mitigations.