{ "document": { "acknowledgments": [ { "organization": "Mitsubishi Electric", "summary": "reported these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).", "title": "Legal Notice and Terms of Use" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could allow a local attacker to tamper with or destroy information in the affected product, cause a denial-of-service condition in the affected product, or execute arbitrary code when a specially crafted archive file is decompressed by the 7-Zip component included in MELSOFT Update Manager.", "title": "Advisory Summary" }, { "category": "other", "text": "Critical Manufacturing", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Japan", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.", "title": "Recommended Practices" }, { "category": "general", "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.", "title": "Recommended Practices" } ], "publisher": { "category": "coordinator", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-26-181-01 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-181-01.json" }, { "category": "self", "summary": "ICSA Advisory ICSA-26-181-01 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks" } ], "title": "Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M", "tracking": { "current_release_date": "2026-06-30T06:00:00.000000Z", "generator": { "date": "2026-06-29T17:14:59.995113Z", "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-26-181-01", "initial_release_date": "2026-06-30T06:00:00.000000Z", "revision_history": [ { "date": "2026-06-30T06:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "Initial Republication of Mitsubishi Electric 2026-004" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": ">=1.000A|<=1.014Q", "product": { "name": "Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M: >=1.000A|<=1.014Q", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "MELSOFT Update Manager SW1DND-UDM-M" } ], "category": "vendor", "name": "Mitsubishi Electric" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-53816", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "A heap-based buffer overflow vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to trigger a buffer overflow that may cause the affected product to enter a denial-of-service condition by convincing a legitimate user to decompress a specially crafted archive file using the affected product. ", "title": "Vulnerability Summary" }, { "category": "details", "text": "SSVCv2/E:N/A:N/2026-06-29T06:00:00.000000Z", "title": "SSVC" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "cwe.mitre.org", "url": "https://cwe.mitre.org/data/definitions/122.html" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53816" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "mitigation", "details": "Mitsubishi Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.co.jp/fa/download/index.html" }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using the PC with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access and allow only trusted users to remote login when internet access is required, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the PC with the affected product and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends preventing users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on the PC with the affected product, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For more information see the associated Mitsubishi Electric security advisory 2026-004: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf.", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" } ], "scores": [ { "cvss_v3": { "baseScore": 5.0, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ] }, { "cve": "CVE-2025-53817", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "A NULL pointer dereference vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to trigger a NULL pointer dereference that may cause the affected product to enter a denial-of-service condition by convincing a legitimate user to decompress a specially crafted archive file using the affected product. ", "title": "Vulnerability Summary" }, { "category": "details", "text": "SSVCv2/E:N/A:N/2026-06-29T06:00:00.000000Z", "title": "SSVC" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "cwe.mitre.org", "url": "https://cwe.mitre.org/data/definitions/476.html" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53817" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "mitigation", "details": "Mitsubishi Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.co.jp/fa/download/index.html" }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using the PC with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access and allow only trusted users to remote login when internet access is required, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the PC with the affected product and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends preventing users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on the PC with the affected product, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For more information see the associated Mitsubishi Electric security advisory 2026-004: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf.", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" } ], "scores": [ { "cvss_v3": { "baseScore": 5.0, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ] }, { "cve": "CVE-2025-55188", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "summary", "text": "A link following vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to tamper with or destroy information by convincing a legitimate user to decompress a specially crafted archive file using the affected product. If the tampered or destroyed files are required for PC operation, the affected PC may enter a denial-of-service condition. ", "title": "Vulnerability Summary" }, { "category": "details", "text": "SSVCv2/E:N/A:N/2026-06-29T06:00:00.000000Z", "title": "SSVC" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "cwe.mitre.org", "url": "https://cwe.mitre.org/data/definitions/59.html" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55188" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H" } ], "remediations": [ { "category": "mitigation", "details": "Mitsubishi Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.co.jp/fa/download/index.html" }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using the PC with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access and allow only trusted users to remote login when internet access is required, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the PC with the affected product and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends preventing users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on the PC with the affected product, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For more information see the associated Mitsubishi Electric security advisory 2026-004: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf.", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" } ], "scores": [ { "cvss_v3": { "baseScore": 7.9, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ] }, { "cve": "CVE-2025-11001", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "summary", "text": "A path traversal vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to execute arbitrary code by decompressing a specially crafted archive file using the affected product. As a result, the affected product may be impacted in ways such as information theft, information tampering, a denial-of-service condition, or other impacts. ", "title": "Vulnerability Summary" }, { "category": "details", "text": "SSVCv2/E:N/A:N/2026-06-29T06:00:00.000000Z", "title": "SSVC" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "cwe.mitre.org", "url": "https://cwe.mitre.org/data/definitions/22.html" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-11001" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" } ], "remediations": [ { "category": "mitigation", "details": "Mitsubishi Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.co.jp/fa/download/index.html" }, { "category": "vendor_fix", "details": "Mitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link \"https://www.mitsubishielectric.co.jp/fa/download/index.html\" (This site is in Japanese) and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf\".", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using the PC with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access and allow only trusted users to remote login when internet access is required, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the PC with the affected product and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends preventing users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For users who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on the PC with the affected product, to minimize the risk of exploitation of this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "For more information see the associated Mitsubishi Electric security advisory 2026-004: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf.", "product_ids": [ "CSAFPID-0001" ], "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ] } ] }