PT-2025-52394 · Mitsubishi · Iconics Suite+6

Published 2025-12-19 · Updated 2025-12-24 · CVE-2025-11774

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior Mitsubishi Electric MC Works64 (affected versions not specified)

Description An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in the software keyboard function (referred to as the "keypad function") of the listed products. A local attacker can execute arbitrary executable files (EXE) when a legitimate user utilizes the keypad function by modifying the function's configuration file. Successful exploitation could lead to the disclosure, modification, deletion, or destruction of information stored on the affected PC, or a denial-of-service (DoS) condition. The vulnerability affects the keypad function specifically.

Recommendations Mitsubishi Electric GENESIS64 versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric ICONICS Suite versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric MobileHMI versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric Iconics Digital Solutions MobileHMI versions prior to 10.97.2 CFR3 should be updated. Mitsubishi Electric MC Works64 (affected versions not specified) should be updated when a fix is available.

Fix

DoS

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-11774

Affected Products

Genesis64

Iconics Suite

Iconics Digital Solutions Genesis64

Iconics Digital Solutions Iconics Suite

Iconics Digital Solutions Mobilehmi

Mc Works64

Mobilehmi

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11774 · Security Note
• https://mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001887467570339969 · Twitter Post
• https://twitter.com/cracbot/status/2003782748990001188 · Twitter Post
• https://twitter.com/TheHackerWire/status/2001829462233813475 · Twitter Post
• https://twitter.com/CVEnew/status/2002099201296249005 · Twitter Post
• https://t.me/cveNotify/146277 · Telegram Post
• https://t.me/CVEtracker/40220 · Telegram Post
• https://jvn.jp/vu/JVNVU97729686 · Note