GENESIS64 CVE-2025-11774
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local config-file tampering by a low-priv attacker (AV:L/PR:L) executes as a legitimate user only when they use the keypad (UI:R), crossing a privilege boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (yd).
CVSS VectorVendor: yd
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.
AnalysisAI
Local attackers with existing low-privileged access to a Windows host running Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI (10.97.2 CFR3 and prior), or MC Works64 (all versions) can tamper with the software keyboard ('keypad') function's configuration file so that it points to an attacker-supplied executable; when a legitimate user next invokes the keypad, that EXE executes in the user's context. The result is arbitrary code execution leading to disclosure, tampering, deletion or destruction of data on the affected PC, or a denial-of-service condition, and the scope change (S:C) reflects that the spawned process is not constrained to the vulnerable component. Exploitation is heavily gated - it requires a pre-existing local foothold, write permission on the keypad configuration file, and a victim actually using the keypad - and there is no public exploit identified at time of analysis, with EPSS at just 0.57% (45th percentile), so this is an access-gated insider/local risk rather than an internet-facing crisis.
Technical ContextAI
The flaw is a classic CWE-78 OS Command Injection pattern applied to a GUI helper: the keypad (on-screen software keyboard) component reads a configuration file to determine which executable to launch, and fails to neutralize special elements in that file, so a writable configuration path becomes an execution vector. The technology stack is Mitsubishi Electric's ICONICS-based HMI/SCADA software family - GENESIS64, ICONICS Suite, MobileHMI (shipped under both the Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions branding) and MC Works64 - deployed on Windows workstations and operator stations. CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (score 8.2) confirms the vector is local-only, low attack complexity, requires low privileges and user interaction, and carries a Scope change because the malicious executable runs in the interactive user's security context rather than the component's own, which is why confidentiality, integrity and availability impacts are all rated High. No CPE strings were supplied, so exact platform enumeration should be confirmed against the vendor advisory at https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf and JVN advisory JVNVU97729686.
Affected ProductsAI
Affected software: Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior; Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior; Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior; Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior; Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior; Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior; and Mitsubishi Electric MC Works64 in all versions. All of these are Windows-hosted HMI/SCADA deployments, and the vulnerable surface is the keypad (software keyboard) function's configuration file on the local machine, so exposure is limited to installations where a local user can reach that file. No CPE strings were included in the provided data; authoritative affected-product details and version tables are in the vendor PSIRT advisory https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf and the JVN coordination advisory https://jvn.jp/vu/JVNVU97729686/.
RemediationAI
Patch availability is not independently confirmed in the data supplied; the authoritative fix and mitigation guidance is in the Mitsubishi Electric PSIRT advisory (https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf) and JVN JVNVU97729686, which should be checked for the current fixed CFR/build and applied to all GENESIS64, ICONICS Suite, MobileHMI and MC Works64 installations, including MC Works64 where all versions are listed as affected. Until that patch is deployed, the highest-value compensating control is to lock down write access to the keypad function's configuration file: restrict NTFS permissions on the affected installation and configuration directories to administrators and the service account only, removing Modify/Write rights from ordinary interactive users, and verify no inherited or share-level permissions re-grant that access (trade-off: users who legitimately customise keypad layout or mappings will lose that ability and must request changes through IT). Because exploitation requires a malicious EXE to run, application allow-listing (Windows AppLocker or WDAC) limited to trusted binaries in the product's installation paths will block the tampered executable outright, at the cost of administrative overhead and possible breakage of legitimate keypad-launched executables. Additionally, run affected HMI workstations under least privilege with no shared local accounts, monitor the keypad process for unexpected child-process creation via EDR, and restrict physical/RDP access to operator stations. These are mitigating measures only and do not fully eliminate the risk - a local attacker who legitimately holds write access to the configuration path can still exploit the flaw, so the vendor patch remains the definitive fix.
More in Mitsubishi Electric
View allLocal block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the
Remote unauthenticated attackers can bypass authentication on Mitsubishi Electric FA products through a specific API rou
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today