Remote Command Execution Vulnerability in Mitsubishi Electric Products
CVE-2025-3232

8.7HIGH

Key Information:

Vendor

Mitsubishi Electric Europe

Status
Smartrtu
Vendor
CVE Published:
24 December 2025

What is CVE-2025-3232?

A vulnerability in Mitsubishi Electric products allows remote unauthenticated attackers to bypass authentication mechanisms. By exploiting a specific API route, these attackers may gain the ability to execute arbitrary operating system commands, potentially compromising the affected systems and data integrity. This security issue highlights the importance of securing API endpoints and implementing robust authentication protocols.

Affected Version(s)

smartRTU 0 <= 3.37

References

https://emea.mitsubishielectric.com/fa/products/quality/q...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
JSON
.
CVE-2025-3232 : Remote Command Execution Vulnerability in Mitsubishi Electric Products