CVE-2025-11774
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An OS command injection vulnerability in the software keyboard (keypad) function of Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, and MC Works64 allows a local attacker to execute arbitrary executable files (EXE) by tampering with the configuration file when a legitimate user uses the keypad function. This could lead to disclosure, tampering, deletion, or destruction of information on the PC, or cause a denial-of-service (DoS) condition.
Risk Assessment
The risk includes the possibility of an attacker executing malicious software with user privileges, potentially leading to compromise of data confidentiality, integrity, or availability, and system disruption.
Recommendation
Update all affected products to the latest versions and restrict local access to systems. Also, monitor configuration file integrity and apply the principle of least privilege.
Other vulnerabilities in Mitsubishi Electric GENESIS64
See all- CVE-2025-14816Critical
A cleartext storage of sensitive information vulnerability in the GUI of Mitsubishi Electric products (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to disclose SQL Server credentials displayed in plain text in the Hyper Historian Splitter feature.
- CVE-2025-14815Critical
A vulnerability in Mitsubishi Electric software (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to read SQL Server credentials stored in plaintext in a local SQLite file. This occurs when local caching using SQLite is enabled and SQL authentication is used.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS