Skip to content
OpenAdvisories
Critical ICSA-25-105-09 2 CVEs

Mitsubishi Electric Europe B.V. smartRTU

Published Apr 15, 2025 · Updated May 6, 2025 · Revision 2

Vendor: Mitsubishi Electric Europe Product: smartRTU

Summary

Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete information in the product, or cause a denial-of service condition on the product.

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-3128

    Mitsubishi Electric Europe smartRTU OS Command Injection

    A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.

    Mitsubishi Electric Europe smartRTU ICS / OT
  • High 7.5
    CVE-2025-3232

    Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function

    A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.

    Mitsubishi Electric Europe smartRTU ICS / OT

Revision history

  1. #2

    Revision - Fixing typos

  2. #1

    Initial Publication

References