Skip to content
OpenAdvisories
Medium ICSA-25-140-04 1 CVE

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update F)

Published May 20, 2025 · Updated Apr 7, 2026 · Revision 7

Vendor: Mitsubishi Electric Vendor: Mitsubishi Electric Iconics Digital Solutions Product: AnalytiX Product: AnalytiX Product: BizViz Product: BizViz Product: GENESIS Product: GENESIS Product: GENESIS32 Product: GENESIS32 Product: GENESIS64 Product: GENESIS64 Product: Hyper Historian Product: Hyper Historian Product: ICONICS Suite Product: ICONICS Suite Product: IoTWorX Product: IoTWorX Product: MC Works64 Product: MobileHMI Product: MobileHMI

Summary

Successful exploitation of this vulnerability could allow a local attacker to make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file, enabling the attacker to destroy the file on a PC with affected products installed and thereby cause a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.

Vulnerabilities 1

  • Medium 6.5
    CVE-2025-0921

    Information Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz

    Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsu…

    Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions MC Works64 ICONICS Suite ICS / OT

Revision history

  1. #7

    Update F -Added MobileHMI, Hyper Historian, AnalytiX, and IoTWorX as affected products, and added information on affected versions and vendor fix for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, and IoTWorX.

  2. #6

    Update E - Updated product list to correct vendor associations in the CSAF

  3. #5

    Update D - Added ICONICS Suite to the affected products list and adjusted the brand name of MC Works64 to Mitsubishi Electric MC Works64

  4. #4

    Update C - Added BizViz and GENESIS32 as affected products, added GENESIS32 and BizViz to the vulnerability description, and added relevant mitigations strategies for GENESIS32 and BizViz as requested by Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric

  5. #3

    Update B - Modified company name to "Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric" and added a statement from Mitsubishi regarding a patched version of GENESIS64 that is in development.

  6. #2

    Update A - Removed AlarmWorX64 wording from the Affected Products section, added reference to other services in the vulnerability overview, removed the multi-agent service disablement mitigation action, and updated CVE description and CVSS score.

  7. #1

    Initial Publication

References