CVE-2025-3784 Mitsubishi Electric CVE debrief

Who should care

Industrial control system engineers, OT security teams, and manufacturing organizations using Mitsubishi Electric GX Works2 for PLC programming should prioritize this vulnerability. Organizations with distributed engineering teams or remote access to programming workstations face elevated risk. Asset owners in critical infrastructure sectors should review project file handling procedures and implement compensating controls until vendor patches are released.

Technical summary

CVE-2025-3784 affects Mitsubishi Electric GX Works2 engineering software used for programming Mitsubishi PLCs. The vulnerability stems from storing authentication credentials in plaintext within project files. An attacker with local access to a workstation or project file can extract these credentials and use them to open password-protected project files, potentially viewing or modifying industrial control logic. The CVSS 3.1 score of 5.5 reflects a local attack vector with low attack complexity and high confidentiality impact, but no integrity or availability impact on the software itself. CISA advisory ICSA-25-338-01 confirms no patched version is currently available. Mitigations focus on access controls, network segmentation, and encryption of project files during transfer.

Defensive priority

medium

Recommended defensive actions

• Restrict physical and network access to engineering workstations running GX Works2; deploy host-based firewalls to block remote logins from untrusted sources
• Segment affected systems from untrusted networks using firewalls or VPNs; limit remote access to authenticated, authorized personnel only
• Encrypt project files when transmitting over any network to prevent credential exposure in transit
• Monitor for unauthorized access attempts to GX Works2 workstations and project file directories
• Apply security updates from Mitsubishi Electric when available; reference vendor security bulletin for patch release timing
• Implement defense-in-depth controls per CISA ICS recommended practices including antivirus deployment on engineering workstations

Evidence notes

CISA published advisory ICSA-25-338-01 on 2025-12-04 confirming plaintext credential storage in GX Works2 project files. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates local attack vector with low complexity and high confidentiality impact. Mitsubishi Electric confirms fixed version is under development.

Official resources