Mitsubishi Electric Systems Face Critical Cybersecurity Risks

Multiple Mitsubishi Electric industrial control systems are vulnerable to critical security flaws that could allow attackers to take control of affected systems, the Cybersecurity and Infrastructure Security Agency (CISA) warned in a release today. The advisory details vulnerabilities across the GENESIS, GENESIS64, ICONICS Suite, and related software, posing a significant risk to critical infrastructure reliant on these technologies.

CISA identifies four Common Vulnerabilities and Exposures (CVEs), including CVE-2023-4863, an out-of-bounds write vulnerability in GENESIS64 and ICONICS Suite that could allow an attacker to execute arbitrary code with administrator privileges by importing a crafted file. More seriously, CVE-2026-16436, affecting a broader range of products, details a weak password recovery mechanism that could allow remote attackers to bypass authentication. The agency assigns a CVSS score of 9.1 to CVE-2023-4863 and 8.2 to CVE-2026-16436, both indicating high severity threats. The implications are substantial: successful exploitation could lead to data theft, system tampering, or denial-of-service conditions.

The agency’s response focuses on remediation, with Mitsubishi Electric releasing fixed versions of several products – notably 10.97.3 for GENESIS64 and ICONICS Suite, and 10.98 for several other affected systems. However, the advisory also provides a range of mitigation strategies for organizations unable to immediately update, including restricting system access to administrators only, blocking remote login, and implementing network segmentation. The breadth of affected versions – spanning from GENESIS64 version 10.97 to 10.97.2 and ICONICS Suite versions 10.97 to 10.97.2 – suggests a potentially extensive patching and upgrade cycle for industrial operators. The detailed mitigation guidance underscores the urgency of addressing these vulnerabilities, given the potential for disruption and compromise.

The disclosure arrives amid escalating concerns about cyberattacks targeting critical infrastructure, as evidenced by recent incidents impacting Indian banks and US military installations. The advisory’s emphasis on vulnerabilities like weak password recovery mechanisms and the need for restricted access aligns with broader industry trends toward zero-trust security models. While the advisory does not quantify the number of systems affected, the widespread deployment of Mitsubishi Electric’s products globally means a significant number of organizations will need to assess and address these vulnerabilities, making a full accounting of the remediation effort a key metric to watch in the coming months.