PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-2542 Mitsubishi Electric CVE debrief

CVE-2016-2542 covers a DLL hijacking issue caused by an uncontrolled search path element in Flexera InstallShield components used by multiple Mitsubishi Electric CNC Series software tools. The CISA CSAF advisory was first published on 2025-07-24 and later updated on 2026-01-29; it lists 19 affected products, with fixed versions for only some products and no planned fixed versions for several others.

Vendor
Mitsubishi Electric
Product
NC Designer2
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-24
Original CVE updated
2026-01-29
Advisory published
2025-07-24
Advisory updated
2026-01-29

Who should care

OT/ICS operators, plant engineers, and IT administrators running Mitsubishi Electric CNC software on Windows systems should review this advisory. Security teams supporting engineering workstations, maintenance laptops, or shared computers used to install or launch the affected tools should also prioritize it.

Technical summary

The issue is a CWE-427 uncontrolled search path element that can enable malicious code execution through DLL hijacking. The supplied CVSS v3.1 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack conditions, high attack complexity, and user interaction requirements. The advisory attributes the issue to Flexera InstallShield behavior used in several Mitsubishi Electric CNC-related products and provides product-specific fixes for NC Trainer2, NC Trainer2 plus, Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224), and NC Virtual Simulator, while stating that several other affected products have no planned fixed version.

Defensive priority

High for systems that install, launch, or maintain the affected Mitsubishi Electric CNC tools, especially shared or operator-facing Windows workstations; moderate elsewhere because the attack requires local access and user interaction.

Recommended defensive actions

  • Inventory all installed Mitsubishi Electric CNC Series products listed in the advisory and compare them against the affected versions.
  • Upgrade NC Trainer2 to version AC or later.
  • Upgrade NC Trainer2 plus to version AC or later.
  • Upgrade Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224) to version A9 or later.
  • Upgrade NC Virtual Simulator to version A5 or later.
  • For products with no planned fixed version, apply the vendor mitigations: restrict physical access, install antivirus software, avoid opening untrusted files or links, and do not run setup-launchers from untrusted or non
  • trusted sources.
  • Before running any setup-launcher, verify that no DLL is present in the folder containing the launcher executable, as directed by the vendor advisory and mitigation guidance.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-25-205-01 (published 2025-07-24, updated 2026-01-29) and its referenced remediation guidance. The advisory explicitly describes a malicious code execution vulnerability via DLL hijacking caused by an uncontrolled search path element (CWE-427) in Flexera InstallShield used by Mitsubishi Electric CNC Series software tools. It also lists 19 affected products, product-specific fixed versions for some items, and states that several products have no planned fixed version. The supplied CVSS v3.1 vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The enrichment indicates the issue is not in CISA KEV.

Official resources

Publicly disclosed by CISA in CSAF advisory ICSA-25-205-01 on 2025-07-24, with an update/republication on 2026-01-29. This debrief uses the advisory publication timeline rather than the CVE identifier year for timing context.