ICONICS and Mitsubishi Electric Products

An attacker could write arbitrary files to the system by tricking a user into unpacking a malicious Pack&Go file, potentially overwriting critical ICONICS configuration files, PLC programs, or system binaries. This could alter process setpoints, disable safety interlocks, or disrupt engineering workstation functionality.

Energy sector operators using ICONICS Product Suite (versions 10.96–10.97.2) for HMI, SCADA, or control system visualization. This affects engineering workstations and any machine where Pack&Go packages are unpacked. Mitsubishi Electric customers using affected components should also review their deployments. Risk is highest where engineering staff handle files from external sources or where workstations lack file integrity monitoring.

An attacker crafts a malicious Pack&Go package with a path traversal payload (directory traversal sequences in filenames). The attacker delivers this file to an engineering workstation user via email or social engineering. When the user unpacks the package using a relative path in the Workbench UI, the malicious files are written to arbitrary locations on the system, potentially overwriting legitimate ICONICS application files or configuration data.