Mitsubishi MELSOFT flaws enable code execution via 7-Zip
Four vulnerabilities in Mitsubishi Electric MELSOFT Update Manager's 7-Zip component allow local attackers to execute code, cause DoS, or tamper with data via crafted archives.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2025-11001 (poc); no exploitation in the wild is recorded.
CISA has issued an advisory for Mitsubishi Electric's MELSOFT Update Manager SW1DND-UDM-M, disclosing four vulnerabilities in its bundled 7-Zip component affecting versions 1.000A through 1.014Q. The flaws include a heap-based buffer overflow (CVE-2025-53816), a NULL pointer dereference (CVE-2025-53817), a link following vulnerability (CVE-2025-55188), and a path traversal issue (CVE-2025-11001). These vulnerabilities require local access and user interaction — specifically, convincing a legitimate user to decompress a specially crafted archive file.
Successful exploitation could result in arbitrary code execution, denial-of-service conditions, or information tampering and destruction. The path traversal vulnerability is the most severe, enabling code execution that could lead to information theft, system compromise, or operational disruption. The product is deployed worldwide in critical manufacturing environments.
Mitsubishi Electric has released version 1.015R to address all four vulnerabilities. For organizations unable to patch immediately, the vendor recommends layered mitigations including network segmentation, restricting physical access, blocking untrusted remote access, enforcing user awareness around email attachments, and deploying antivirus software. CISA notes that no public exploitation has been reported and the vulnerabilities are not remotely exploitable.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by 7-Zip Extraction Utility
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process spawned by 7-Zip components (as bundled with MELSOFT Update Manager) launching a script host or command interpreter shortly after archive extraction, consistent with code execution via a crafted archive exploiting a 7-Zip vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by 7-Zip Extraction Utility
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
filter:
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
- \\explorer.exe
suspicious_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\rundll32.exe
- \\mshta.exe
- \\regsvr32.exe
condition: selection and suspicious_child and not filter
falsepositives:
- Users manually running scripts or command tools immediately after using 7-Zip for
legitimate archive management
- Automated build or deployment pipelines invoking 7-Zip followed by scripted post-extraction
steps
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 8561f4c7-56c9-5803-9bc0-a4a440c29bae
status: experimental
author: Vorant
Archive Extraction Writing Files Outside Target Directory (Path Traversal)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file creation events where an extracted file path contains directory traversal sequences, indicative of exploitation of the 7-Zip path traversal vulnerability (CVE-2025-11001) bundled in MELSOFT Update Manager when a user opens a crafted archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Extraction Writing Files Outside Target Directory
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
traversal:
TargetFilename|contains:
- ..\\
- ../
condition: selection and traversal
falsepositives:
- Legitimate archives that intentionally contain relative path entries within an expected
subdirectory structure (rare with well-formed archives)
level: high
tags:
- attack.t1204.002
- attack.execution
id: f2da3764-2b37-55cb-bc5d-2ae52396b0b1
status: experimental
author: Vorant
MELSOFT Update Manager Spawning 7-Zip Extraction Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects MELSOFT Update Manager launching bundled 7-Zip binaries to process an archive, establishing a baseline parent-child relationship useful for correlating subsequent suspicious child processes or file writes indicative of exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MELSOFT Update Manager Spawning 7-Zip Extraction Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: MELSOFT
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
condition: selection
falsepositives:
- Normal MELSOFT Update Manager update or package extraction workflows using the bundled
7-Zip component
level: low
tags:
- attack.t1204.002
- attack.execution
id: d8bec5cd-59a0-5e44-a89a-613d0df97218
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs