Execution with Unnecessary Privileges vulnerability in the Pager agent of multi-agent notification feature in Mitsubishi Electric Iconics Digital Solutions GENESIS64 prior to 10.97.3, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
| Link | Tags |
|---|---|
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-002_en.pdf | vendor advisory |
| https://jvn.jp/vu/JVNVU93838985 | government resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04 | government resource |