A vulnerability in the Pager agent of the multi-agent notification feature in Mitsubishi Electric Iconics Digital Solutions GENESIS64 prior to version 10.97.3, as well as all versions of Mitsubishi Electric GENESIS64 and MC Works64, allows a local authenticated attacker to perform unauthorized writes to arbitrary files. This is achieved by creating a symbolic link from a file used as a write destination by the affected services to a target file, potentially leading to a denial-of-service (DoS) condition on the affected PC.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-0921 |
Exploitation
To exploit this vulnerability, an attacker with local authenticated access can create a symbolic link from a writable file used by the affected services to a target file. This action allows the attacker to overwrite or destroy the target file, which may be critical for the operation of the PC, leading to a denial-of-service condition.
Affected Products
- Mitsubishi Electric Iconics Digital Solutions GENESIS64 (versions prior to 10.97.3)
- Mitsubishi Electric GENESIS64 (all versions)
- Mitsubishi Electric MC Works64 (all versions)
Mitigation
To mitigate this vulnerability, it is recommended to update the affected products to the latest version where the vulnerability has been addressed. Additionally, restricting local access to the systems running these applications can help prevent unauthorized exploitation.
References