Mitsubishi Electric Europe smartRTU OS Command Injection
CVE-2025-3128
9.3CRITICAL
What is CVE-2025-3128?
A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.
Affected Version(s)
smartRTU 0 <= 3.37
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Noam Moshe of Claroty Team82 reported this vulnerability to CISA.