Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

### Executive summary This advisory describes an Incorrect Privilege Assignment (CWE-266) affecting numerous Mitsubishi Electric and ICONICS products (53 product entries) where installers grant excessive default DCOM permissions to the product administrator account, allowing an attacker with that account to launch/operate DCOM objects locally or remotely and potentially disclose, tamper with, destroy data or cause DoS; vendor fixes (version 10.98 or later for several products) are available and mitigations are provided for unpatched systems.