PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-25087 Mitsubishi Electric CVE debrief

A local denial-of-service vulnerability in 37 Mitsubishi Electric FA engineering software products allows an attacker with low privileges to trigger a Windows blue screen error (BSOD) if malicious code is already executing on the target system. The vulnerability requires high attack complexity and user interaction, limiting its practical exploitability. CISA published the initial advisory on 2024-05-14, with the most recent update (Update E) released on 2026-01-15 adding further version-specific mitigation guidance.

Vendor
Mitsubishi Electric
Product
CPU Module Logging Configuration Tool
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2026-01-15
Advisory published
2024-05-14
Advisory updated
2026-01-15

Who should care

Organizations operating Mitsubishi Electric industrial automation systems, particularly manufacturing facilities, critical infrastructure operators, and system integrators using GX Works2/3, GT Designer3, MX Component, or other affected FA engineering software on Windows-based engineering workstations.

Technical summary

CVE-2024-25087 is a local vulnerability affecting 37 Mitsubishi Electric FA engineering software products. If malicious code executes on a system with affected software installed, a local attacker with low privileges can trigger a Windows blue screen error, resulting in denial-of-service. The attack requires high complexity and user interaction. CVSS 3.1 score: 4.4 (Medium). The vulnerability does not impact confidentiality or integrity. CISA's advisory ICSA-24-135-04 (Update E, January 2026) provides version-specific update guidance for all affected products.

Defensive priority

medium

Recommended defensive actions

  • Inventory all Mitsubishi Electric FA engineering software installations and identify affected versions per CISA advisory ICSA-24-135-04
  • Apply vendor-provided updates to affected products: CPU Module Logging Configuration Tool to 1.160S+, CW Configurator to 1.020W+, Data Transfer to 3.59M+, Data Transfer Classic to 1.01B+, FR Configurator2 to 1.33K+, GT系列
  • For products without direct updates available (CSGL, EZSocket), contact your Mitsubishi Electric place of purchase for assistance
  • Consider upgrading GENESIS64 and ICONICS Suite to GENESIS version 11 or later as a successor migration path
  • Implement defense-in-depth controls including application whitelisting, least-privilege execution, and network segmentation for engineering workstations
  • Monitor for unexpected process crashes or BSOD events on systems running affected Mitsubishi Electric software

Evidence notes

Source: CISA CSAF advisory ICSA-24-135-04 (Update E), published 2024-05-14, modified 2026-01-15. CVSS 3.1 vector: AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H. Affects 37 Mitsubishi Electric FA engineering software products including GX Works2, GX Works3, GT Designer3, MX Component, and others.

Official resources

2024-05-14