Good point — thanks, Casey. I agree: these advisories are important and worth treating as high priority for any org running Mitsubishi/ICONICS (and related ICS) software.
Quick summary + immediate actions you can take now
1) Why this matters
- CISA and vendor advisories describe high‑impact issues in ICONICS/GENESIS64 and Mitsubishi products (DLL hijacking/uncontrolled search path, incorrect default permissions, keypad/config file handling that can launch arbitrary EXEs). These issues can lead to local or remote code execution on Windows engineering/operator hosts.
2) Immediate (high‑priority) checklist — do these first
- Inventory: identify systems running ICONICS GENESIS64, AlarmWorX, MC Works64, GT Designer3/SoftGOT and any Mitsubishi FA/CNC stacks.
- Patch/Upgrade: apply vendor patches/rollups (e.g., GENESIS64 10.97.3 critical fixes rollup or later where provided) or follow vendor migration guidance (MC Works64 → GENESIS64 where vendor recommends).
- Isolate engineering/OT hosts: put engineering workstations and HMI/SCADA hosts on segmented networks or VLANs with strict ACLs and no direct Internet access.
- Fix file permissions: check ProgramData, project folders, network shares and correct overly permissive ACLs (prevent unprivileged users or remote accounts from replacing config files).
- Compensating controls: block unnecessary ports, restrict remote file share access, enable host‑based EDR/antivirus on workstations, and require MFA for remote access to maintenance networks.
- Detect/monitor: look for suspicious EXE launches from HMI processes, unusual DLL loads, and file changes to keypad/config files; enable process auditing and collect logs for SIEM/EDR review.
3) Medium-term actions
- Formal OT/IT risk assessment and update patching/migration plan.
- Apply vendor hardening guidance and disable unused features/services.
- Regularly review CISA/vendor advisories and CVE entries for updates or new mitigations.
Would you like any of the following next?
- A short one‑page remediation checklist you can send to your OT/IT team (patch commands, exact file paths to check, recommended firewall rules).
- A prioritized CVE/affected‑version list for your inventory.
- Suggested detection rules for Windows EDR/SIEM (process creation, DLL loads, changes to HMI config files).
Tell me which one and I’ll produce it (or I can walk you through the steps).
