Loading story…
Palo Alto Networks Unit 42 reported CVE-2025-0921, a medium-severity (CVSS 6.5) vulnerability in Mitsubishi Electric Iconics Digital Solutions GENESIS64 (Iconics Suite) affecting Windows deployments 10.97.2 and earlier. The issue involves unnecessary privileges across multiple services, enabling misuse of privileged file system operations that could corrupt critical binaries and lead to integrity/availability impact, including a potential denial-of-service (DoS) condition; Unit 42 coordinated disclosure with Iconics, and the vendor published mitigations/workarounds intended to address the reported issues.
Separately, reporting highlighted a CISA warning on CVE-2025-26385, a critical (CVSS 10.0) vulnerability in Johnson Controls Metasys building automation components (including ADS/ADX, SCT, CCT, and certain NAE/LCS engines across specified version ranges). The flaw is described as a remote SQL injection / remote SQL execution condition that could allow unauthorized SQL command execution, potentially enabling alteration or loss of data used to manage building environments; Johnson Controls and CISA recommended applying the vendor patch (e.g., GIV-165989 via the License Portal) and following compensating controls where patching is not immediately possible.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The vendor security team coordinated disclosure with the researchers and released an advisory and workaround that reportedly mitigates all vulnerabilities reported during the assessment. This marked the official vendor response to the ICONICS Suite issues.
Researchers showed that CVE-2025-0921 can be chained with CVE-2024-7587 by modifying a writable configuration file and using a crafted symbolic link to redirect logging output into sensitive files such as the Windows cng.sys driver. Triggering a test SMS or alert can overwrite the target binary and leave Windows unable to boot after restart.
Unit 42 disclosed CVE-2025-0921, a medium-severity vulnerability in Mitsubishi Electric Iconics Digital Solutions GENESIS64/Iconics Suite that allows privileged file system operations in the Pager Agent component. A local low-privileged attacker could abuse it to overwrite critical system binaries, causing denial of service and loss of integrity or availability.
Johnson Controls made the Metasys patch for GIV-165989 available through its License Portal and, along with CISA, urged immediate patching. For systems that cannot be patched right away, the advisory recommended closing inbound TCP port 1433, segmenting networks, and avoiding exposure to untrusted networks.
CISA issued a warning for CVE-2025-26385, a CVSS 10.0 SQL injection vulnerability affecting Johnson Controls Metasys Application and Data Server and related configuration tools. The flaw could allow remote SQL execution to alter or destroy data used to control physical building environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed multiple vulnerabilities affecting **ICONICS Suite**, **GENESIS64**, **GENESIS32**, **MC Works64**, and related products used in industrial and manufacturing environments. CISA said the flaws include **deserialization-based remote code execution**, **path traversal**, inclusion of functionality from an untrusted control sphere, and an **out-of-bounds read** that could lead to information disclosure or denial of service. The most severe issue carries a **CVSS v3.1 score of 9.8**, and affected versions include GENESIS64 and ICONICS Suite `10.97` through `10.97.1`, **MC Works64** up to `4.04E`, and **GENESIS32** up to `9.7`. A separate updated advisory also detailed an **information tampering** flaw caused by execution with unnecessary privileges across additional ICONICS-related products, including **MobileHMI**, **Hyper Historian**, **AnalytiX**, **IoTWorX**, **GENESIS**, and **BizViz**. CISA said a low-privileged local attacker could create a symbolic link and abuse service file writes to overwrite arbitrary files, potentially destroying files and causing denial of service, a weakness tracked under **CWE-250** and rated **CVSS 6.5**. Vendor fixes are available for several current product lines, including version `10.98` or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version `10.96` or later for IoTWorX, and version `11.01` or later for GENESIS, while no fixes are planned for some legacy products such as **MC Works64**, **GENESIS32**, and **BizViz**; operators are urged to isolate affected systems, restrict remote and physical access, and use firewalls or VPNs.
Jun 29, 2026
CISA updated advisories for **Mitsubishi Electric Iconics Digital Solutions** and related Mitsubishi products after disclosure of a high-severity malicious code execution vulnerability in the **Phone agent** used by the multi-agent notification feature. The flaw is an **uncontrolled search path element** issue tracked as **`CWE-427`** and affects **GENESIS64**, **ICONICS Suite**, **MC Works64**, **GENESIS32**, and **Hyper Historian**. According to the advisory, all versions of **MC Works64** and **GENESIS32** are impacted, while **GENESIS64**, **ICONICS Suite**, and **Hyper Historian** are affected through version **10.97.3**; CISA also referenced related updates covering Mitsubishi HMI/SCADA deployments. Exposure depends on whether the multi-agent notification feature and **Phone agent** are installed and, in some cases, whether a **Dialogic telephony board driver** is present. Mitsubishi said a fix is available in version **10.98** or later for some environments that do not require the Phone agent, but no fix is planned for **MC Works64**, **GENESIS32**, or certain Phone agent use cases. CISA and Mitsubishi recommended removing the multi-agent notification feature if it is not needed, avoiding Phone agent installation during custom setup, installing the Dialogic driver where applicable, and tightening network segmentation, remote access, email handling, and physical access controls. The vulnerability carries a **CVSS v3.1 score of 7.8**.
Jun 29, 2026
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed a high-severity vulnerability affecting multiple **GENESIS64**, **ICONICS Suite**, **MobileHMI**, **Hyper Historian**, **AnalytiX**, **GENESIS**, and **MC Works 64** products. The flaw, tracked as **CWE-312** for cleartext storage of sensitive information, occurs when local caching with SQLite is enabled and SQL authentication is used, causing SQL Server credentials to be stored in plaintext in local cache files. CISA said the issue could allow information disclosure and could also enable tampering or denial-of-service conditions; the advisory assigned the vulnerability a **CVSS v3.1 score of 8.8**. Mitsubishi Electric released fixes in **version 10.98 or later** for several affected product lines and **version 11.03 or later** for GENESIS, while **no fix is planned for MC Works 64**. CISA and the vendor urged operators to disable local cache where possible, delete cached database files, use **Windows authentication** instead of SQL authentication, and reduce exposure by restricting administrative and remote access, segmenting affected systems on internal networks, and limiting physical and network access to industrial control environments.
Jun 29, 2026