# Critical Vulnerabilities in Mitsubishi Electric MELSOFT Update Manager Threaten Industrial Control Systems **Mitsubishi Electric** has issued an urgent advisory regarding several critical vulnerabilities found in its **MELSOFT Update Manager SW1DND-UDM-M** software. These flaws, stemming from the embedded **7-Zip** component, could allow local attackers to compromise systems within critical manufacturing environments worldwide. ## Affected Systems The vulnerabilities impact **MELSOFT Update Manager SW1DND-UDM-M** versions from **1.000A** up to and including **1.014Q**. Organizations using these versions are strongly advised to review the official advisories and apply necessary mitigations. ## The Vulnerabilities: A Closer Look The identified vulnerabilities carry a **CVSS v3 score of 8.8**, indicating a high severity risk. They include a range of serious issues that, when exploited, can lead to significant operational disruptions and data integrity compromises. ### CVE-2025-53816: Heap-based Buffer Overflow This vulnerability in the **7-Zip** component could allow a local attacker to trigger a buffer overflow. By convincing a legitimate user to decompress a specially crafted archive file, an attacker could cause a denial-of-service condition in the affected product. This is categorized as **CWE-122 Heap-based Buffer Overflow**. ### CVE-2025-53817: NULL Pointer Dereference Another flaw in the **7-Zip** component, this NULL pointer dereference vulnerability could also lead to a denial-of-service condition. Similar to the buffer overflow, it relies on a user decompressing a malicious archive file. This aligns with **CWE-476 NULL Pointer Dereference**. ### CVE-2025-55188: Improper Link Resolution ('Link Following') This link following vulnerability could enable a local attacker to tamper with or destroy information. If critical system files are affected, it could lead to a denial-of-service condition for the entire PC. This is classified under **CWE-59 Improper Link Resolution Before File Access ('Link Following')**. ### CVE-2025-11001: Path Traversal A path traversal vulnerability in the **7-Zip** component could allow a local attacker to execute arbitrary code. Exploitation could result in information theft, data tampering, or a denial-of-service condition, among other impacts. This falls under **CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')**. ## Critical Infrastructure Impact Given that **Mitsubishi Electric** products are widely deployed in the Critical Manufacturing sector globally, these vulnerabilities pose a substantial threat to industrial control systems (ICS). The potential for tampering, destruction of information, or arbitrary code execution could disrupt critical operations and supply chains. ## Mitigation and Recommendations **CISA** (Cybersecurity and Infrastructure Security Agency) has republished these vulnerabilities, acknowledging **Mitsubishi Electric** for reporting them. CISA strongly recommends that organizations implement defensive measures to minimize the risk of exploitation. Key recommendations include: * **Impact Analysis and Risk Assessment:** Perform thorough assessments before deploying defensive measures. * **Defense-in-Depth Strategies:** Implement robust cybersecurity practices for ICS assets. * **Social Engineering Awareness:** Educate users to avoid clicking suspicious links or opening unsolicited attachments, referring to CISA's guidance on avoiding email scams and phishing attacks. At present, no known public exploitation of these specific vulnerabilities has been reported to CISA. It's crucial to note that these vulnerabilities are not remotely exploitable, requiring local access or user interaction for successful exploitation. Organizations observing any suspected malicious activity are encouraged to follow established internal procedures and report findings to CISA for tracking and correlation.