1. EXECUTIVE SUMMARY
- CVSS v4 4.1
- ATTENTION: Low attack complexity
- Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric
- Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64
- Vulnerability: Windows Shortcut Following (.LNK)
2. RISK EVALUATION
Successful exploitation of this vulnerability could result in information tampering.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of ICONICS Product Suite and Mitsubishi Electric MC Works64 are affected:
- GENESIS64: All versions
- GENESIS: Version 11.00
- Mitsubishi Electric MC Works64: All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 Windows Shortcut Following (.LNK) CWE-64
An information tampering vulnerability due to Windows Shortcut Following exists in multiple processes in GENESIS64, MC Works64, and GENESIS. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. By creating a symbolic link, an attacker can cause the processes to make unauthorized writes to arbitrary files on the file system in any location that is accessible to the user under which the elevated processes are running, resulting in a denial-of-service (DoS) condition on the PC if the modified file is necessary for the operation of the PC.
CVE-2025-7376 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.9 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-7376. A base score of 4.1 has been calculated; the CVSS vector string i
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: