The vulnerability is an incorrect privilege assignment in several Mitsubishi Electric products, enabling users who have administrator credentials to launch and operate DCOM objects without proper elevation. This effectively grants those users the ability to execute arbitrary code with system‑level permissions, potentially allowing disclosure, modification, destruction of data, or denial of service. The weakness is classified as CWE-266.

Affected vendors and products include Mitsubishi Electric Corporation and Mitsubishi Electric Iconics Digital Solutions for a range of control system software such as GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64. Any installation of version 10.97.3 or earlier for these products is impacted; all versions of MC Works64 are also vulnerable. The vulnerability results from installers granting excessive DCOM permissions to the administrator account during installation.

The CVSS base score of 9.4 indicates critical severity, though the EPSS score is under 1%, suggesting that exploitation attempts are presently rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker possess or compromise an administrator account, which is typically accessible to local or remote users depending on network topology. Once authenticated, the attacker can elevate privileges by launching DCOM objects that normally require UAC, leading to potential data loss, tampering, or service disruption. The high severity combined with the low industry exploitation probability implies that patching should be prioritized, but organizations with remote administrators or exposed interfaces should assess the risk of an authenticated attacker further.