{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Asher Davila"
        ],
        "organization": "Palo Alto Networks",
        "summary": "reported this vulnerability to Mitsubishi Electric and CISA"
      },
      {
        "names": [
          "Malav Vyas"
        ],
        "organization": "Palo Alto Networks",
        "summary": "reported this vulnerability to Mitsubishi Electric and CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability could allow a local attacker to make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file, enabling the attacker to destroy the file on a PC with affected products installed and thereby cause a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "other",
        "text": "This ICSA is a verbatim republication of Mitsubishi Electric 2025-002 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory.  Further, CISA does not endorse any commercial product or service.  Please contact Mitsubishi Electric directly for any questions regarding this advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Japan",
        "title": "Company headquarters location"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-25-140-04 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-140-04.json"
      },
      {
        "category": "self",
        "summary": "Mitsubishi Electric Advisory 2025-002",
        "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-25-140-04 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      }
    ],
    "title": "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update F)",
    "tracking": {
      "current_release_date": "2026-04-07T05:00:00.000000Z",
      "generator": {
        "date": "2026-04-01T20:08:48.448403Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.5.0"
        }
      },
      "id": "ICSA-25-140-04",
      "initial_release_date": "2025-05-20T04:00:00.000000Z",
      "revision_history": [
        {
          "date": "2025-05-20T04:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        },
        {
          "date": "2025-08-07T04:00:00.000000Z",
          "legacy_version": "Additional Release 1",
          "number": "2",
          "summary": "Update A - Removed AlarmWorX64 wording from the Affected Products section, added reference to other services in the vulnerability overview, removed the multi-agent service disablement mitigation action, and updated CVE description and CVSS score."
        },
        {
          "date": "2025-08-28T04:00:00.000000Z",
          "legacy_version": "Additional Release 2",
          "number": "3",
          "summary": "Update B - Modified company name to \"Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric\" and added a statement from Mitsubishi regarding a patched version of GENESIS64 that is in development."
        },
        {
          "date": "2026-01-08T05:00:00.000000Z",
          "legacy_version": "Additional Release 3",
          "number": "4",
          "summary": "Update C - Added BizViz and GENESIS32 as affected products, added GENESIS32 and BizViz to the vulnerability description, and added relevant mitigations strategies for GENESIS32 and BizViz as requested by Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric"
        },
        {
          "date": "2026-01-29T05:00:00.000000Z",
          "legacy_version": "Additional Release 4",
          "number": "5",
          "summary": "Update D - Added ICONICS Suite to the affected products list and adjusted the brand name of MC Works64 to Mitsubishi Electric MC Works64"
        },
        {
          "date": "2026-02-12T05:00:00.000000Z",
          "legacy_version": "Additional Release 5",
          "number": "6",
          "summary": "Update E - Updated product list to correct vendor associations in the CSAF"
        },
        {
          "date": "2026-04-07T00:00:00.000000Z",
          "legacy_version": "Additional Release 6",
          "number": "7",
          "summary": "Update F -Added MobileHMI, Hyper Historian, AnalytiX, and IoTWorX as affected products, and added information on affected versions and vendor fix for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, and IoTWorX."
        }
      ],
      "status": "final",
      "version": "7"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric GENESIS64: \u003c=10.97.3",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric ICONICS Suite: \u003c=10.97.3",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric MobileHMI: \u003c=10.97.3",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "MobileHMI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Hyper Historian: \u003c=10.97.3",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Hyper Historian"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric AnalytiX: \u003c=10.97.3",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "AnalytiX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.95",
                "product": {
                  "name": "Mitsubishi Electric IoTWorX: 10.95",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "IoTWorX"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric GENESIS32: vers:all/*",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric BizViz: vers:all/*",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "BizViz"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.00",
                "product": {
                  "name": "Mitsubishi Electric GENESIS: 11.00",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric MC Works64: vers:all/*",
                  "product_id": "CSAFPID-0010"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS64: \u003c=10.97.3",
                  "product_id": "CSAFPID-0011"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: \u003c=10.97.3",
                  "product_id": "CSAFPID-0012"
                }
              }
            ],
            "category": "product_name",
            "name": "ICONICS Suite"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions MobileHMI: \u003c=10.97.3",
                  "product_id": "CSAFPID-0013"
                }
              }
            ],
            "category": "product_name",
            "name": "MobileHMI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions Hyper Historian: \u003c=10.97.3",
                  "product_id": "CSAFPID-0014"
                }
              }
            ],
            "category": "product_name",
            "name": "Hyper Historian"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=10.97.3",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions AnalytiX: \u003c=10.97.3",
                  "product_id": "CSAFPID-0015"
                }
              }
            ],
            "category": "product_name",
            "name": "AnalytiX"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.95",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions IoTWorX: 10.95",
                  "product_id": "CSAFPID-0016"
                }
              }
            ],
            "category": "product_name",
            "name": "IoTWorX"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*",
                  "product_id": "CSAFPID-0017"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS32"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*",
                  "product_id": "CSAFPID-0018"
                }
              }
            ],
            "category": "product_name",
            "name": "BizViz"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.00",
                "product": {
                  "name": "Mitsubishi Electric Iconics Digital Solutions GENESIS: 11.00",
                  "product_id": "CSAFPID-0019"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric Iconics Digital Solutions"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-0921",
      "cwe": {
        "id": "CWE-250",
        "name": "Execution with Unnecessary Privileges"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information tampering vulnerability due to Execution with Unnecessary Privileges exists in multiple services in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz. This vulnerability could allow a local attacker to make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the target file on a PC with affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-04-07T00:00:00Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-0921"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/250.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf\".",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads?tabset-a9d51=51905\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".",
          "product_ids": [
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 10.96 or later for IoTWorX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf\".",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.96 or later for IoTWorX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/iconics-software/a375a000004qDU8AAM/iotworx\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".",
          "product_ids": [
            "CSAFPID-0016"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric is releasing fixed version 11.01 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf\".",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.01 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".",
          "product_ids": [
            "CSAFPID-0019"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "no_fix_planned",
          "details": "Mitsubishi Electric has no plans to release fixed versions for MC Works64, GENESIS32, and BizViz. For users of MC Works64, GENESIS32, and BizViz, refer to the Mitsubishi Electric security advisory \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf\", and take the actions described there.",
          "product_ids": [
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0010"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
        },
        {
          "category": "no_fix_planned",
          "details": "Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 and BizViz. For users of GENESIS32 and BizViz, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\", and take the actions described there.",
          "product_ids": [
            "CSAFPID-0017",
            "CSAFPID-0018"
          ],
          "url": "https://iconics.com/about/security/cert"
        },
        {
          "category": "mitigation",
          "details": "For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        },
        {
          "category": "mitigation",
          "details": "For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        },
        {
          "category": "mitigation",
          "details": "For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        },
        {
          "category": "mitigation",
          "details": "For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        },
        {
          "category": "mitigation",
          "details": "For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017",
            "CSAFPID-0018",
            "CSAFPID-0019"
          ]
        }
      ]
    }
  ]
}

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric IoTWorX versions 10.95, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric BizViz all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS versions 11.00, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions IoTWorX versions 10.95, Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions, Mitsubishi Electric Iconics Digital Solutions BizViz all versions,  and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de ejecuci\u00f3n con privilegios innecesarios en el agente Pager de la funci\u00f3n de notificaci\u00f3n multiagente de Mitsubishi Electric Iconics Digital Solutions GENESIS64 anterior a la versi\u00f3n 10.97.3, Mitsubishi Electric GENESIS64 en todas sus versiones y Mitsubishi Electric MC Works64 en todas sus versiones permite a un atacante local autenticado realizar escrituras no autorizadas en archivos arbitrarios mediante la creaci\u00f3n de un enlace simb\u00f3lico desde un archivo utilizado como destino de escritura por los servicios de los productos afectados a un archivo de destino. Esto podr\u00eda permitir al atacante destruir el archivo en un PC con los productos afectados instalados, lo que provocar\u00eda una denegaci\u00f3n de servicio (DoS) en el PC si el archivo destruido es necesario para su funcionamiento."
    }
  ],
  "id": "CVE-2025-0921",
  "lastModified": "2026-04-09T06:16:22.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0,
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-05-15T23:15:58.943",
  "references": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "url": "https://jvn.jp/vu/JVNVU93838985"
    },
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04"
    },
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
    }
  ],
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ],
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-15T23:15:58Z",
    "severity": "MODERATE"
  },
  "details": "Execution with Unnecessary Privileges vulnerability in the Pager agent of multi-agent notification feature in Mitsubishi Electric Iconics Digital Solutions GENESIS64 prior to 10.97.3, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.",
  "id": "GHSA-j7fr-xvx6-3p7v",
  "modified": "2026-04-09T06:30:26Z",
  "published": "2025-05-16T00:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0921"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/vu/JVNVU93838985"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04"
    },
    {
      "type": "WEB",
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-002_en.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}