CVE-2025-11774CWE-78command-injection

CVE-2025-11774

High · published December 19, 2025

CVSS v3.1
8.2
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

🚨 A crafty configuration tweak could turn your keypad into a command center for mischief! With this OS Command Injection vulnerability, attackers can execute arbitrary files on Mitsubishi Electric software like GENESIS64. 🔥 Think of it like a restaurant where a diner can sneak into the kitchen by tampering with the menu. Instead of just ordering food, they might start cooking up something dangerous and serve it to the unsuspecting patrons! An attacker could unleash havoc—disclose sensitive information, tamper with essential files, or even delete critical data. Picture the chaos of a system going down during a crucial operation, leading to a denial-of-service condition. The consequences could be absolutely devastating! ⚡

Put simply

Think of it like a restaurant where a diner can sneak into the kitchen by tampering with the menu. Instead of just ordering food, they might start cooking up something dangerous and serve it to the unsuspecting patrons! This vulnerability stems from improper handling of special elements in the keypad function, allowing local attackers to manipulate the configuration file and execute any executable file they choose. This is essentially an open door for executing malicious commands in the system!

What to do

An attacker could unleash havoc—disclose sensitive information, tamper with essential files, or even delete critical data. Picture the chaos of a system going down during a crucial operation, leading to a denial-of-service condition. The consequences could be absolutely devastating! ⚡ To protect your system, patch to versions beyond 10.97.2 CFR3 immediately! Ensure proper configurations are in place and review user access controls to tighten security. Regular audits can help spot any misconfigurations before they become an issue. 🛡️ You've got this! With a quick patch and some vigilance, you can fortify your defenses against this sneaky flaw! 💪

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-19T06:16Z
References (2)
EPSS history
Timeline
  • 19 DEC 00:22Z
    Malicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works64
    cvelistv5