PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-25086 Mitsubishi Electric CVE debrief

A local privilege escalation vulnerability in 37 Mitsubishi Electric FA engineering software products allows attackers with local access and user privileges to gain Windows system privileges and execute arbitrary commands. The vulnerability requires high attack complexity and user interaction, with a medium CVSS 3.1 score of 4.4. CISA published the initial advisory on May 14, 2024, with the most recent Update E released on January 15, 2026, adding version information to affected product and mitigation sections. No known exploitation in the wild has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Mitsubishi Electric
Product
CPU Module Logging Configuration Tool
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2026-06-09
Advisory published
2024-05-14
Advisory updated
2026-06-09

Who should care

Organizations using Mitsubishi Electric FA engineering software in industrial automation environments, particularly manufacturing, process control, and critical infrastructure sectors. System administrators, OT security teams, and asset owners responsible for maintaining secure engineering workstations should prioritize inventory and patching activities.

Technical summary

The vulnerability exists in multiple Mitsubishi Electric FA engineering software products where malicious code execution on an affected system can lead to local privilege escalation. The attack requires local access, low privileges, and user interaction, with high attack complexity. Successful exploitation grants Windows system privileges and arbitrary command execution. The CVSS 3.1 score is 4.4 (Medium) with vector AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N, indicating local attack vector, high attack complexity, low privileges required, user interaction required, and high impact to integrity. Thirty-seven products are affected including GX Works2, GX Works3, GT Designer3, MX Component, and various configuration and monitoring tools. Vendor fixes are available for most products through the Mitsubishi Electric download portal, with some requiring purchase assistance.

Defensive priority

medium

Recommended defensive actions

  • Inventory all Mitsubishi Electric FA engineering software installations and identify affected versions using the product list in the CISA advisory
  • Apply vendor-provided updates: CPU Module Logging Configuration Tool to 1.160S or later; GX Works2 to 1.625B or later; GX Works3 to 1.110Q or later; and corresponding updates for other affected products per the advisory
  • For products requiring purchase assistance (CSGL, EZSocket), contact your Mitsubishi Electric place of purchase
  • Restrict local access to engineering workstations running affected software to authorized personnel only
  • Implement application whitelisting and endpoint protection on engineering workstations to prevent malicious code execution
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Monitor for anomalous privilege escalation attempts on systems running affected Mitsubishi Electric software

Evidence notes

Source: CISA CSAF advisory ICSA-24-135-04 (Update E, published 2026-01-15). CVSS 3.1 vector: AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N. Affected products include CPU Module Logging Configuration Tool (≤1.154L), GX Works2 (≤1.622Y), GX Works3 (≤1.106L), and 34 additional Mitsubishi Electric FA engineering software products.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-25086 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-25086

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-25086 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-25086

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-135-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.