A vulnerability in the Pager agent of the multi-agent notification feature in Mitsubishi Electric Iconics Digital Solutions GENESIS64 prior to version 10.97.3, as well as all versions of Mitsubishi Electric GENESIS64 and MC Works64, allows a local authenticated attacker to perform unauthorized writes to arbitrary files. This is achieved by creating a symbolic link from a file used as a write destination by the affected services to a target file, potentially leading to a denial-of-service (DoS) condition if the destroyed file is essential for the PC’s operation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-0921 |
Exploitation
To exploit this vulnerability, an attacker with local access must authenticate to the affected system and create a symbolic link from a writable file used by the services of the affected products to a target file. This action can lead to unauthorized file modifications, potentially causing critical files to be deleted and resulting in a denial-of-service condition.
Affected Products
- Mitsubishi Electric Iconics Digital Solutions GENESIS64 (versions prior to 10.97.3)
- Mitsubishi Electric GENESIS64 (all versions)
- Mitsubishi Electric MC Works64 (all versions)
Mitigation
To mitigate this vulnerability, it is recommended to update the affected products to the latest version, specifically GENESIS64 version 10.97.3 or later. Additionally, restricting local access to the systems and monitoring for unauthorized file modifications can help reduce the risk of exploitation.