1. EXECUTIVE SUMMARY
- CVSS v4 8.3
- ATTENTION: Low attack complexity
- Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric
- Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64
- Vulnerability: Execution with Unnecessary Privileges
2. RISK EVALUATION
Successful exploitation of this vulnerability could result in information tampering on the target workstation.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Mitsubishi Electric Iconics Digital Solutions reports that the following versions of ICONICS Product Suite and Mitsubishi Electric MC Works64 are affected:
- GENESIS64 AlarmWorX Multimedia (AlarmWorX64 MMX): All Versions
- Mitsubishi Electric MC Works64 AlarmWorX Multimedia (AlarmWorX64 MMX): All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
An execution with unnecessary privileges vulnerability in the AlarmWorX64 MMX Pager agent can provide the potential for information tampering. An attacker could make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the Pager Agent service of GENESIS64 and MC Works64 to a target file. This could allow the attacker to destroy the file on a PC with GENESIS64 or MC Works64 installed, resulting in a denial-of-service (DoS) condition on the PC.
CVE-2025-0921 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-0921. A base score of 8.3 has been calculated; the CVSS vector string is (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H.
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Japan
3.4 RESEARCHER
Asher Davila and Malav Vyas from Palo Alto Networks reported this vulnerability to Mitsubishi Electric and CISA.
4. MITIGATIONS
Mitsubishi Electric recommends that users take the following mitigations to minimize the risk of exploiting this vulnerability:
- If you do not need to use the multi-agent notification feature, please uninstall it. The multi-agent notification feature is not included in the default installation of GENESIS64TM version 10.97.3 or later. For users engaging the multi-agent notification feature who do not also need to the Pager agent, please execute a custom installation of the multi-agent notification feature and skip the installation of the Pager agent.
- Please configure the PCs with the affected product installed so that only an administrator can log in.
- PCs with the affected product installed should be configured to block remote logins from untrusted networks and hosts, and from non-administrator users.
- Block unauthorized access by using a firewall or virtual private network (VPN), etc., and allow remote login only to administrators when connecting the PCs with the affected product installed to the Internet.
- Restrict physical access to the PC with the affected product installed and the network to which the PC is connected to prevent unauthorized physical access.
- Do not click on web links in emails from untrusted sources. Also, do not open attachments in untrusted emails.
- Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommends updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found at the following link: https://partners.iconics.com/Home.aspx. Note that a login is required.
- Refer to the Mitsubishi Electric Iconics Digital Solutions Whitepaper on Security Vulnerabilities, the most recent version of which can be found at: https://iconics.com/About/Security/CERT
- Refer to the Mitsubishi Electric security advisory at: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf for information on the availability of the security updates.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
- Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
- Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
5. UPDATE HISTORY
- May 20, 2025: Initial Publication
