This vulnerability (CVE-2024-8299) involves an uncontrolled search path element in Mitsubishi Electric GENESIS64 (versions 10.97.3 and prior), ICONICS Suite, Hyper Historian, GENESIS32, MC Works64, and related products. It allows a local authenticated attacker to execute arbitrary code by placing a malicious DLL in a specific folder that the software loads from. The impact includes potential data disclosure, tampering, destruction, deletion, or denial of service. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector with low complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability. A patch is available from the vendor to remediate this vulnerability.

Successful exploitation allows a local authenticated attacker to execute arbitrary code via DLL hijacking, leading to potential disclosure, tampering, destruction, or deletion of information, or causing denial of service in affected Mitsubishi Electric products. The impact affects confidentiality, integrity, and availability at a high level.

An official patch is available to address this vulnerability. Users should apply the vendor-provided updates to affected Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 products to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch locally. No vendor advisory content contradicts this guidance.