CVE-2025-11774 Overview
CVE-2025-11774 is an OS command injection vulnerability [CWE-78] affecting the software keyboard (keypad) function in multiple Mitsubishi Electric and Iconics Digital Solutions HMI/SCADA products. A local attacker who can tamper with the keypad configuration file can execute arbitrary executables when a legitimate user invokes the keypad. Successful exploitation allows disclosure, modification, or destruction of data on the host, or a denial-of-service condition on the affected system. The flaw impacts GENESIS64, ICONICS Suite, MobileHMI (versions 10.97.2 CFR3 and prior), and all versions of MC Works64.
Critical Impact
Local attackers can achieve arbitrary code execution with the privileges of the legitimate user invoking the keypad, enabling data tampering, destruction, or denial of service on industrial HMI/SCADA hosts.
Affected Products
- Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior (also distributed by Iconics Digital Solutions)
- Mitsubishi Electric ICONICS Suite and MobileHMI versions 10.97.2 CFR3 and prior (also distributed by Iconics Digital Solutions)
- Mitsubishi Electric MC Works64 (all versions)
Discovery Timeline
- 2025-12-19 - CVE-2025-11774 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11774
Vulnerability Analysis
The vulnerability resides in the software keyboard (keypad) function bundled with Mitsubishi Electric GENESIS64 and related HMI/SCADA products. The keypad function reads a configuration file at runtime to determine its behavior. Special elements inside that configuration are not properly neutralized before being passed to the operating system for command execution. When a legitimate operator invokes the keypad, the manipulated configuration causes the process to launch attacker-supplied executables. Because the code runs inside a trusted HMI process, the resulting execution inherits the operator's privileges on the workstation.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The keypad component treats fields from its configuration file as trusted input and hands them to a command execution routine without sanitization or allow-listing. Any account able to write to the configuration file therefore controls a code execution primitive that fires the next time the keypad is used.
Attack Vector
The attack vector is local and requires low privileges plus user interaction. An attacker with local access modifies the keypad configuration file to reference a chosen .exe. When an authenticated operator later opens the keypad during normal workflow, the affected product launches the referenced executable. Scope is changed, meaning the impact can cross the security boundary of the vulnerable component to affect the host operating system and any data reachable by the operator account. Refer to the Mitsubishi Electric Vulnerability Advisory and the JVN Security Vulnerability Report for vendor technical details.
Detection Methods for CVE-2025-11774
Indicators of Compromise
- Unexpected modifications to keypad configuration files under GENESIS64, ICONICS Suite, MobileHMI, or MC Works64 installation directories.
- Child processes spawned by GENESIS64/ICONICS/MobileHMI/MC Works64 host processes that launch cmd.exe, powershell.exe, or unknown executables.
- New or unsigned executables placed in HMI project directories or user-writable paths referenced by keypad configuration.
Detection Strategies
- Monitor file integrity on keypad and HMI configuration files, alerting on writes by any account other than authorized engineering users.
- Alert on process-lineage anomalies where ICONICS or GENESIS64 processes act as parents of shells, script interpreters, or LOLBins.
- Correlate operator logon events with subsequent execution of non-standard binaries on the HMI workstation.
Monitoring Recommendations
- Enable command-line and process-creation auditing (Windows Event ID 4688 with command-line logging) on all HMI hosts.
- Forward endpoint telemetry from HMI/SCADA workstations to a central SIEM or data lake for behavioral analysis.
- Baseline the set of executables invoked by the keypad function so deviations are flagged for review.
How to Mitigate CVE-2025-11774
Immediate Actions Required
- Inventory all Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, and MC Works64 installations and confirm version 10.97.2 CFR3 or prior.
- Restrict file-system permissions on keypad configuration files so only trusted administrator accounts can modify them.
- Enforce least privilege for HMI operator accounts and remove local administrator rights where not required.
- Review the Mitsubishi Electric Vulnerability Advisory for vendor-supplied remediation steps.
Patch Information
Mitsubishi Electric has published advisory 2025-018 describing affected versions and remediation guidance. Apply the fixed release identified in that advisory for GENESIS64, ICONICS Suite, and MobileHMI. MC Works64 is listed as affected in all versions, so follow the vendor's mitigation guidance until a fix is confirmed for that product line.
Workarounds
- Apply access control lists so only authorized engineering accounts can read or modify keypad configuration files.
- Disable or avoid use of the software keypad function on hosts where it is not required for operations.
- Deploy application allow-listing on HMI workstations to prevent execution of unapproved executables spawned from HMI processes.
- Segment HMI/SCADA workstations from general IT networks to limit the ability of a local attacker to stage a malicious executable.
# Configuration example: restrict write access to keypad configuration files (Windows PowerShell)
# Replace <PathToKeypadConfig> with the actual installation directory
$path = "<PathToKeypadConfig>"
icacls $path /inheritance:r
icacls $path /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls $path /grant:r "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
