CVE-2025-7376
BaseFortify
Publication date: 2025-08-06
Last updated on: 2026-04-09
Assigner: Mitsubishi Electric Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitsubishi | electric | mc_works64 |
| mitsubishi | electric | genesis64 |
| mitsubishi | electric | genesis |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-64 | The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves Windows Shortcut Following (.LNK) in multiple Mitsubishi Electric Iconics Digital Solutions products. A local authenticated attacker can create a symbolic link from a file used as a write destination by the affected processes to an arbitrary target file. This allows the attacker to write unauthorized data to that target file.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to destroy files on a PC with the affected products installed. If the destroyed file is necessary for the operation of the PC, this can result in a denial-of-service (DoS) condition, disrupting normal operations.