Skip to content
Fencer Vulns
high 8.2

CVE-2025-11774 json

Malicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works64

published 2025-12-19 10 mo ago modified 2026-10-07 33 d ago also EUVD-2025-204434

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-352-04 updated cvss 8.2

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products

  • Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric GENESIS64 <=10.97.2_CFR_3
    affected: vendor fix, mitigation “Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3."” iconicsinc.my.site.com
  • Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric ICONICS Suite <=10.97.2_CFR_3
    affected: mitigation “Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3."” iconicsinc.my.site.com
  • Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MC Works64 Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MobileHMI <=10.97.2_CFR_3
    affected: vendor fix, mitigation “Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3."” iconicsinc.my.site.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
10 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

  • Mitsubishi Electric Corporation GENESIS64
  • Mitsubishi Electric Iconics Digital Solutions GENESIS64
  • Mitsubishi Electric Corporation ICONICS Suite
  • Mitsubishi Electric Iconics Digital Solutions ICONICS Suite
  • Mitsubishi Electric Corporation MobileHMI
  • Mitsubishi Electric Iconics Digital Solutions MobileHMI
  • Mitsubishi Electric Corporation MC Works64

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.