Mitsubishi Electric Automation MC-WorX Suite Unsecure ActiveX Control

An attacker could trick a plant operator or engineer into visiting a malicious webpage or opening an email attachment, then execute arbitrary commands on their engineering workstation with the user's privileges. This could allow the attacker to modify automation projects, control logic, or gain access to the plant network.

Energy sector organizations—particularly electric utilities and industrial power generation facilities—using Mitsubishi Electric MC-WorX Suite version 8.02 for automation and control system engineering. This affects any operator or engineer who uses their workstation for both automation engineering and internet-connected activities (web browsing, email).

An attacker creates a malicious web page or email containing a reference to the vulnerable ActiveX control. When an engineer working on MC-WorX Suite accesses the web page or email in an unpatched browser, the control is instantiated and the attacker's code runs with the engineer's permissions. The attacker can then modify automation projects or pivot to other systems on the plant network.