This vulnerability (CVE-2024-1574) involves unsafe reflection (CWE-470) in the licensing feature of Mitsubishi Electric Iconics Digital Solutions GENESIS64 and several related products. It allows a local attacker with low privileges to execute arbitrary code with administrative rights by modifying a specific file that lacks proper protection. The affected versions include GENESIS64 and other products up to version 10.97.2. The CVSS 3.1 base score is 6.7, reflecting a medium severity with local attack vector, high attack complexity, low privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability. A patch is available from the vendor to remediate this issue.

Successful exploitation allows a local attacker to execute malicious code with administrative privileges by tampering with an unprotected file in the licensing feature. This can lead to full system compromise affecting confidentiality, integrity, and availability of the affected systems. The attack requires local access and user interaction, and has high attack complexity.

A patch is available for this vulnerability. It is recommended to apply the official vendor updates to affected Mitsubishi Electric Iconics Digital Solutions products at or below version 10.97.2. Since the vulnerability requires local access and file tampering, ensure that file system permissions are properly configured to restrict unauthorized modifications. Monitor vendor advisories for the latest patch information and apply updates promptly.