CVE-2025-55188 7-Zip CVE debrief

Who should care

Users of MELSOFT Update Manager SW1DND-UDM-M, particularly those in industrial control systems, should be aware of this vulnerability and take steps to mitigate it. This includes operators of critical infrastructure, IT administrators responsible for managing MELSOFT Update Manager SW1DND-UDM-M deployments, and security teams responsible for monitoring and responding to potential security incidents.

Technical summary

A link following vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to tamper with or destroy information by convincing a legitimate user to decompress a specially crafted archive file using the affected product. If the tampered or destroyed files are required for PC operation, the affected PC may enter a denial-of-service condition.

Defensive priority

High priority to update MELSOFT Update Manager SW1DND-UDM-M to version 1.015R or later, and implement network security controls to prevent unauthorized access.

Recommended defensive actions

• Update MELSOFT Update Manager SW1DND-UDM-M to version 1.015R or later
• Use a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access
• Restrict physical access to the PC with the affected product and the network to which the PC is connected
• Prevent users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails
• Install anti-virus software on the PC with the affected product
• Regularly review system logs for signs of potential tampering or unauthorized access
• Implement a robust backup strategy to minimize potential impact in case of a denial-of-service condition

Evidence notes

The source item URL https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-181-01.json provides details on the vulnerability and mitigation strategies. The vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. Users should verify the integrity of downloaded files and exercise caution when decompressing archive files. Defenders should review system logs for signs of potential tampering or unauthorized access. Additionally, users should ensure that their MELSOFT Update Manager SW1DND-UDM-M is updated to version 1.015R or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.