Mitsubishi Electric Advises Patches for Ten Critical Vulnerabilities Across GENESIS and ICONICS Platforms

Mitsubishi Electric has issued coordinated security advisories addressing a total of four CVEs across its GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz product lines. The most severe flaw, tracked as CVE-2023-4863, is an out-of-bounds write vulnerability caused by the libwebp internal component in GENESIS64 and ICONICS Suite. This flaw, with a CVSS v3 base score of 9.1, could allow an authenticated local attacker to trigger a heap-based buffer overflow by importing a crafted file, potentially leading to arbitrary code execution, information disclosure, or a denial-of-service condition.

Three additional vulnerabilities—CVE-2026-16436, CVE-2026-16437, and CVE-2026-16438—affect a broader set of products including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. These flaws relate to weak password recovery mechanisms, incorrect privilege assignments, and can allow attackers to bypass authentication or perform arbitrary operations. Impact ranges from information disclosure and data tampering to system-destroying denial-of-service conditions.

Affected version ranges vary by product. GENESIS64 and ICONICS Suite versions from 10.97 up to and including 10.97.2 are impacted by CVE-2023-4863. Earlier and current versions of GENESIS (≤11.03) and the 10.97.3 and earlier line of the other affected platforms are vulnerable to the 2026-series CVEs. Mitsubishi Electric has released fixed versions 10.97.3 or later for GENESIS64 and ICONICS Suite, and users are urged to update immediately. The vendor also recommends interim mitigations such as restricting administrator logins, blocking remote access from untrusted networks, and limiting physical access to affected systems.

The advisories note that these products are deployed worldwide, with a significant presence in the Critical Manufacturing sector. No confirmed active exploitation in the wild was reported at the time of publication, though the severity of the CVSS scores and the potential for remote abuse warrant urgent attention.