OS Command Injection Vulnerability in Mitsubishi Electric Software Products
CVE-2025-11774

8.2HIGH

Key Information:

Vendor

Mitsubishi Electric Corporation

Status
Genesis64
Iconics Suite
Mobilehmi
Mc Works64
Vendor
CVE Published:
19 December 2025

What is CVE-2025-11774?

An OS Command Injection vulnerability exists in the software keyboard function of multiple Mitsubishi Electric products. This vulnerability allows local attackers to execute arbitrary executable files by manipulating configuration files during legitimate user interaction with the keypad function. Such exploitation can lead to unauthorized access to sensitive information, alteration or deletion of data, and may even result in denial-of-service (DoS) scenarios, severely impacting the affected system.

Affected Version(s)

GENESIS64 Version 10.97.2 CFR3 and prior

GENESIS64 Version 10.97.2 CFR3 and prior

ICONICS Suite Version 10.97.2 CFR3 and prior

References

https://jvn.jp/vu/JVNVU97729686/
government-resource
https://www.mitsubishielectric.com/psirt/vulnerability/pd...
vendor-advisory

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.