# Mitsubishi Electric Patches Critical Vulnerability Chain in MELSOFT Update Manager


## The Threat


Mitsubishi Electric has disclosed four critical vulnerabilities affecting the MELSOFT Update Manager SW1DND-UDM-M, a widely deployed software suite used to manage firmware and updates for industrial automation equipment and programmable logic controllers (PLCs). The vulnerability chain—affecting versions 1.000A through 1.014Q—stems from a flaw in the bundled 7-Zip component and could allow local attackers to execute arbitrary code, destroy data, or disable critical manufacturing systems.


The MELSOFT Update Manager is integral to the operational ecosystem of Mitsubishi Electric's factory automation products, which are deployed in facilities worldwide spanning automotive, pharmaceutical, food and beverage, and other critical manufacturing sectors. Organizations using this software to manage PLC firmware updates are potentially exposed if they operate systems on networks where an attacker has local access—a realistic scenario in industrial environments where contractors, vendors, and remote technicians frequently interact with production infrastructure.


The vulnerability requires social engineering: an attacker must convince a user to decompress a specially crafted archive file using the affected MELSOFT Update Manager. When the vulnerable 7-Zip component processes the malicious archive, it triggers a heap-based buffer overflow or path traversal condition, leading to code execution with the privileges of the user running the update manager. Given that firmware updates are often performed by senior technicians or engineers with elevated system permissions, exploitation could grant access to sensitive industrial control systems.


## Severity and Impact


| Identifier | Score | Vector / Details | Attack Vector | Complexity | Privileges Required |

|---|---|---|---|---|---|

| CVE-2025-53816 | CVSS 8.8 | Heap-based Buffer Overflow; CWE-122 | Local | Low | Low |

| CVE-2025-53817 | CVSS 8.8 | NULL Pointer Dereference; CWE-476 | Local | Low | Low |

| CVE-2025-55188 | CVSS 8.8 | Path Traversal / Link Following; CWE-59 | Local | Low | Low |

| CVE-2025-11001 | CVSS 8.8 | Improper Pathname Restriction; CWE-22 | Local | Low | Low |


All four vulnerabilities carry a maximum CVSS score of 8.8, reflecting a critical risk level. The attack vector is local, meaning the attacker must have some level of access to the target machine—either direct physical access, remote desktop access, or the ability to deliver a malicious file through email or file sharing. Once triggered, exploitation can result in:


  • Arbitrary code execution with the privileges of the user running the update manager
  • Denial of service by crashing the update manager or the system itself
  • Data tampering including modification or destruction of firmware images, configuration files, or operational data
  • Loss of production visibility if the update manager is disabled or compromised

    • ## Affected Products


  • Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M (versions 1.000A through 1.014Q)

    • The affected software is commonly found on engineering workstations, technician laptops, and IT management servers in manufacturing environments. Any organization using MELSOFT for PLC and factory automation device management should assume exposure if running an affected version.


    ## Mitigations


    Immediate Action: Vendor Patch


    Mitsubishi Electric is releasing fixed version 1.015R and later. Organizations should:

    1. Download the update from the official Mitsubishi Electric download portal at https://www.mitsubishielectric.co.jp/fa/download/index.html

    2. Review the formal security advisory at https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf

    3. Test the patch in a non-production environment before broad deployment

    4. Schedule and deploy the fix across all machines running MELSOFT Update Manager


    Temporary Controls for Organizations Unable to Patch Immediately


    If immediate patching is not feasible:


  • Network Isolation: Restrict the affected system to operate within a LAN only; block remote logins from untrusted networks and disable internet-facing access where possible.
  • Firewall and VPN Controls: Implement strict firewall rules and require VPN authentication for any remote access to systems running MELSOFT Update Manager.
  • Physical Access Restrictions: Limit physical access to machines with the affected software; prevent unauthorized personnel from accessing the update manager or connected production equipment.
  • Email and Attachment Security: Educate users not to click links or open attachments from untrusted sources. Archive files should only be decompressed from known, verified sources.
  • User Privilege Review: Ensure users running MELSOFT Update Manager have only the minimum privileges necessary; remove unnecessary local administrator rights where possible.
  • Disable Auto-Decompression: If the software supports it, disable automatic decompression of archives and require manual user confirmation before processing any archive files.

    • ## References


  • Mitsubishi Electric Official Advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdf
  • Download Center: https://www.mitsubishielectric.co.jp/fa/download/index.html
  • CVE-2025-53816: Heap-based buffer overflow in 7-Zip component
  • CVE-2025-53817: NULL pointer dereference
  • CVE-2025-55188: Path traversal and link-following vulnerability
  • CVE-2025-11001: Pathname restriction bypass

    • ---


    ## HackWire Analysis


    This advisory exemplifies a critical and often-overlooked supply chain risk in industrial automation: the reliance on third-party components—in this case, the 7-Zip compression library—within mission-critical software. While 7-Zip is open-source and generally well-maintained, the integration of any external component into privileged software introduces inherited vulnerabilities. Mitsubishi Electric did not create the underlying 7-Zip flaws; they inherited them by bundling the library into MELSOFT Update Manager.


    The vulnerability's severity is amplified by manufacturing's operational reality. Unlike desktop software where users can often defer patches indefinitely, PLC firmware updates are frequently mandated by regulatory compliance, security updates from the device vendor, or production requirements. An attacker aware of this pressure could craft a convincing phishing email claiming to be from Mitsubishi Electric or an integrator, attached to a malicious archive, and rely on technicians' urgency to decompress it without validation. The social engineering surface—"we need to apply this critical firmware update"—is high.


    This also illustrates a broader pattern in industrial control systems: update managers themselves have become attack vectors. Similar vulnerabilities have been discovered in update managers for other automation vendors. The lesson for defenders is clear: sandbox or air-gap systems running firmware updates, mandate strict verification of update sources, and treat update management tools with the same rigor as the production systems they manage. For Mitsubishi Electric customers, the immediate priority is patching to 1.015R; for everyone else, this should trigger an audit of update manager security across your entire OT and IT infrastructure.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)