View CSAF
1. EXECUTIVE SUMMARY
- CVSS v4 4.1
- ATTENTION: Low attack complexity
- Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric
- Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64
- Vulnerability: Windows Shortcut Following (.LNK)
2. RISK EVALUATION
Successful exploitation of this vulnerability could result in information tampering.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of ICONICS Product Suite and Mitsubishi Electric MC Works64 are affected:
- GENESIS64: All versions
- GENESIS: Version 11.00
- Mitsubishi Electric MC Works64: All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 Windows Shortcut Following (.LNK) CWE-64
An information tampering vulnerability due to Windows Shortcut Following exists in multiple processes in GENESIS64, MC Works64, and GENESIS. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. By creating a symbolic link, an attacker can cause the processes to make unauthorized writes to arbitrary files on the file system in any location that is accessible to the user under which the elevated processes are running, resulting in a denial-of-service (DoS) condition on the PC if the modified file is necessary for the operation of the PC.
CVE-2025-7376 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.9 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-7376. A base score of 4.1 has been calculated; the CVSS vector string is (AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Japan
3.4 RESEARCHER
Mitsubishi Electric reported this vulnerability to CISA.
4. MITIGATIONS
Mitsubishi Iconics Digital Solutions recommends users upgrade to GENESIS Version 11.01, which contains a fix for this vulnerability. For the highest level of security, it is recommended that users upgrade their system to the latest version and keep it up-to-date with the latest releases. Consult Mitsubishi Electric Iconics Digital Solutions Support for upgrade assistance.
Users who remain on affected versions should be aware of this information tampering vulnerability and take any necessary precautions to keep the system safe from potential attackers such as:
- Configure the PCs with the affected product installed so that only an administrator can log in.
- PCs with the affected product installed should be configured to block remote logins from untrusted networks and hosts, and from non-administrator users.
- Block unauthorized access by using a firewall or virtual private network (VPN), etc., and allow remote login only to administrators when connecting the PCs with the affected product installed to the Internet.
- Restrict physical access to the PC with the affected product installed and the network to which the PC is connected to prevent unauthorized physical access.
- Do not click on web links in emails from untrusted sources. Also, do not open attachments in untrusted emails.
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommends updating the ICONICS Suite with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required).
For more information, see Mitsubishi Electric’s security advisory.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
5. UPDATE HISTORY
- August 5, 2025: Initial Publication