CVE-2025-0921

Description

Execution with Unnecessary Privileges vulnerability in the Pager agent of multi-agent notification feature in Mitsubishi Electric Iconics Digital Solutions GENESIS64 prior to 10.97.3, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.

Reserved 2025-01-31 | Published 2025-05-15 | Updated 2025-05-29 | Assigner Mitsubishi

Problem types

CWE-250 Execution with Unnecessary Privileges

Product status

Default status
unaffected

all versions
affected

Default status
unaffected

all versions
affected

Default status
unaffected

prior to version 10.97.3
affected

Credits

Asher Davila of Palo Alto Networks finder

Malav Vyas of Palo Alto Networks finder

References

www.mitsubishielectric.com/...nerability/pdf/2025-002_en.pdf vendor-advisory

jvn.jp/vu/JVNVU93838985 government-resource

www.cisa.gov/news-events/ics-advisories/icsa-25-140-04 government-resource

cve.org (CVE-2025-0921)

nvd.nist.gov (CVE-2025-0921)

Download JSON