CVE Intelligence

Vulnerabilidades de Mitsubishi Electric Corporation

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Mitsubishi Electric Corporation: 20 registro(s), com severidade, exploração e correções.

MC Works64 6MobileHMI 6ICONICS Suite 6GENESIS64 6AnalytiX 5Hyper Historian 5GENESIS 4MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP 3MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP 3Melsec Iq-f Fx5-eip Firmware 2Melsec Iq-f Fx5-enet/ip Firmware 2IoTWorX 2BizViz 2GENESIS32 2Mitsubishi Electric CNC M800V Series M800VW 1Mitsubishi Electric CNC M800V Series M800VS 1Mitsubishi Electric CNC M80V Series M80V 1Mitsubishi Electric CNC M80V Series M80VW 1Mitsubishi Electric CNC M800 Series M800W 1Mitsubishi Electric CNC M800 Series M800S 1Mitsubishi Electric CNC M80 Series M80 1Mitsubishi Electric CNC E80 Series E80 1Mitsubishi Electric CNC C80 Series C80 1Mitsubishi Electric CNC M700V Series M750VW 1Mitsubishi Electric CNC M700V Series M720VW 1Mitsubishi Electric CNC M700V Series M730VW 1Mitsubishi Electric CNC M700V Series M720VS 1Mitsubishi Electric CNC M700V Series M750VS 1Mitsubishi Electric CNC M70V Series M70V 1Mitsubishi Electric CNC E70 Series E70 1MILCO.S Setting Application 1MILCO.S Setting Application (IR) 1MILCO.S Easy Setting Application (IR) 1MILCO.S Easy Switch Application (IR) 1GX Works2 1GT Designer3 Version1 (GOT2000) 1GT Designer3 Version1 (GOT1000) 1Room Air Conditioners (for Japan) MSZ-BKR2223-W 1Room Air Conditioners (for Japan) MSZ-BKR2224-W 1Room Air Conditioners (for Japan) MSZ-BKR2523-W 1

Somente exploradas (KEV) →

CVE-2026-16438 Crítica · 9.4 CWE-266 15/10/2026
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVE-2026-16437 Alta · 7.1 CWE-640 15/10/2026
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVE-2026-16436 Crítica · 9.2 CWE-640 15/10/2026
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVE-2026-15688 Crítica · 9.2 CWE-303 17/09/2026
Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.
CVE-2026-8806 Alta · 8.7 CWE-440 19/06/2026
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module
Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being performed, and causing the communication function to stop.
CVE-2026-8805 Alta · 8.7 CWE-190 19/06/2026
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series EtherNet/IP module
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
CVE-2026-5667 Alta · 7.2 CWE-798 17/06/2026
Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside Japan); Refrigerators (for Japan); Heat Pump Water Heaters / HEMS-Compatible Adapters / Wireless LAN Adapters (for Japan); Bathroom Dryer / Heater / Ventilation Systems (for Japan); Adapters for Airflow Ventilation Systems, Heat Pump Chilled / Hot Water Systems, and Ventilation / Air-Conditioning System Air Resorts (for Japan); Lossnay Central Ventilation Systems (for Japan); Smart Switches for Ventilation Fans and Lossnay (for Japan); IH Cooking Heaters (for Japan); and Rice Cookers (for Japan) allows an attacker within Wi-Fi radio range of an affected product to access the affected product using a hard-coded SSID and password, thereby obtaining device data such as operation status, room set temperature, and room temperature; changing the air-conditioner or Wi-Fi settings; or causing Wi-Fi communication to enter a denial-of-service (DoS) condition.
CVE-2025-14816 Crítica · 9.3 CWE-317 08/04/2026
Produtos Mitsubishi Electric GENESIS64 e ICONICS: armazenamento em texto claro de credenciais do SQL Server
Vulnerabilidade de Armazenamento em Texto Claro de Informações Sensíveis em GUI nos produtos Mitsubishi Electric GENESIS64 versões 10.97.3 e anteriores, Mitsubishi Electric ICONICS Suite versões 10.97.3 e anteriores, Mitsubishi Electric MobileHMI versões 10.97.3 e anteriores, Mitsubishi Electric Hyper Historian versões 10.97.3 e anteriores, Mitsubishi Electric AnalytiX versões 10.97.3 e anteriores, Mitsubishi Electric GENESIS versões 11.02 e anteriores, Mitsubishi Electric MC Works64 todas as versões, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions MobileHMI versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions AnalytiX versões 10.97.3 e anteriores e Mitsubishi Electric Iconics Digital Solutions GENESIS versões 11.02 e anteriores permite que um atacante local divulgue as credenciais do SQL Server exibidas em texto simples na GUI do recurso Hyper Historian Splitter ao explorar esta vulnerabilidade, quando a autenticação SQL é usada para a autenticação no SQL Server. Como resultado, o atacante não autorizado poderia acessar o SQL Server e divulgar, adulterar ou destruir dados no servidor, potencialmente causando uma condição de negação de serviço (DoS) no sistema.
CVE-2025-14815 Crítica · 9.3 CWE-312 08/04/2026
Mitsubishi Electric GENESIS64 e suíte ICONICS: armazenamento em texto claro de credenciais do SQL Server
Vulnerabilidade de Armazenamento em Texto Claro de Informações Sensíveis na Mitsubishi Electric GENESIS64 nas versões 10.97.3 e anteriores, Mitsubishi Electric ICONICS Suite nas versões 10.97.3 e anteriores, Mitsubishi Electric MobileHMI nas versões 10.97.3 e anteriores, Mitsubishi Electric Hyper Historian nas versões 10.97.3 e anteriores, Mitsubishi Electric AnalytiX nas versões 10.97.3 e anteriores, Mitsubishi Electric GENESIS nas versões 11.02 e anteriores, Mitsubishi Electric MC Works64 todas as versões, Mitsubishi Electric Iconics Digital Solutions GENESIS64 nas versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite nas versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions MobileHMI nas versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions Hyper Historian nas versões 10.97.3 e anteriores, Mitsubishi Electric Iconics Digital Solutions AnalytiX nas versões 10.97.3 e anteriores e Mitsubishi Electric Iconics Digital Solutions GENESIS nas versões 11.02 e anteriores permite que um atacante local divulgue as credenciais do SQL Server armazenadas em texto claro no arquivo SQLite local ao explorar esta vulnerabilidade, quando o recurso de cache local usando SQLite está habilitado e a autenticação SQL é usada para a autenticação no SQL Server. Como resultado, o atacante não autorizado poderia acessar o SQL Server e divulgar, adulterar ou destruir dados no servidor, potencialmente causando uma condição de negação de serviço (DoS) no sistema.
CVE-2025-2399 Média · 5.9 CWE-1285 10/03/2026
Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683.
CVE-2026-1876 Alta · 7.5 CWE-404 03/03/2026
Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series Ethernet module
Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
CVE-2026-1875 Alta · 7.5 CWE-404 03/03/2026
Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module
Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
CVE-2026-1874 Alta · 7.5 CWE-670 03/03/2026
Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module
Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
CVE-2025-15080 Alta · 8.8 CWE-1284 05/02/2026
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.
CVE-2025-10314 Alta · 8.8 CWE-276 05/02/2026
Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.
CVE-2025-11774 Alta · 8.2 CWE-78 18/12/2025
Malicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works64
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.
CVE-2025-11009 Média · 5.1 CWE-312 16/12/2025
Information Disclosure Vulnerability in GT Designer3
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designer3 Version1 (GOT1000) all versions allows a local unauthenticated attacker to obtain plaintext credentials from the project file for GT Designer3. This could allow the attacker to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials.
CVE-2025-3784 Média · 5.5 CWE-312 27/11/2025
Information Disclosure Vulnerability in GX Works2
Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext from project files. As a result, the attacker may be able to open project files protected by user authentication using disclosed credential information, and obtain or modify project information.
CVE-2025-10089 Alta · 7.7 CWE-427 18/11/2025
Malicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S
Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced.
CVE-2025-10259 Média · 5.3 CWE-1284 06/11/2025
Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module
Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets to cause a denial-of-service (DoS) condition on the products. There is no impact on connections other than the attacked one.