Mitsubishi MELSOFT flaws enable code execution via 7-Zip
Four vulnerabilities in Mitsubishi Electric MELSOFT Update Manager's 7-Zip component allow local attackers to execute code, cause DoS, or tamper with data via crafted archives.
CISA has issued an advisory for Mitsubishi Electric's MELSOFT Update Manager SW1DND-UDM-M, disclosing four vulnerabilities in its bundled 7-Zip component affecting versions 1.000A through 1.014Q. The flaws include a heap-based buffer overflow (CVE-2025-53816), a NULL pointer dereference (CVE-2025-53817), a link following vulnerability (CVE-2025-55188), and a path traversal issue (CVE-2025-11001). These vulnerabilities require local access and user interaction — specifically, convincing a legitimate user to decompress a specially crafted archive file.
Successful exploitation could result in arbitrary code execution, denial-of-service conditions, or information tampering and destruction. The path traversal vulnerability is the most severe, enabling code execution that could lead to information theft, system compromise, or operational disruption. The product is deployed worldwide in critical manufacturing environments.
Mitsubishi Electric has released version 1.015R to address all four vulnerabilities. For organizations unable to patch immediately, the vendor recommends layered mitigations including network segmentation, restricting physical access, blocking untrusted remote access, enforcing user awareness around email attachments, and deploying antivirus software. CISA notes that no public exploitation has been reported and the vulnerabilities are not remotely exploitable.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by 7-Zip Extraction Utility
Detects a process spawned by 7-Zip components (as bundled with MELSOFT Update Manager) launching a script host or command interpreter shortly after archive extraction, consistent with code execution via a crafted archive exploiting a 7-Zip vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by 7-Zip Extraction Utility
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
filter:
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
- \\explorer.exe
suspicious_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\rundll32.exe
- \\mshta.exe
- \\regsvr32.exe
condition: selection and suspicious_child and not filter
falsepositives:
- Users manually running scripts or command tools immediately after using 7-Zip for
legitimate archive management
- Automated build or deployment pipelines invoking 7-Zip followed by scripted post-extraction
steps
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 8561f4c7-56c9-5803-9bc0-a4a440c29bae
status: experimental
author: Vorant
Archive Extraction Writing Files Outside Target Directory (Path Traversal)
Detects file creation events where an extracted file path contains directory traversal sequences, indicative of exploitation of the 7-Zip path traversal vulnerability (CVE-2025-11001) bundled in MELSOFT Update Manager when a user opens a crafted archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Extraction Writing Files Outside Target Directory
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
traversal:
TargetFilename|contains:
- ..\\
- ../
condition: selection and traversal
falsepositives:
- Legitimate archives that intentionally contain relative path entries within an expected
subdirectory structure (rare with well-formed archives)
level: high
tags:
- attack.t1204.002
- attack.execution
id: f2da3764-2b37-55cb-bc5d-2ae52396b0b1
status: experimental
author: Vorant
MELSOFT Update Manager Spawning 7-Zip Extraction Process
Detects MELSOFT Update Manager launching bundled 7-Zip binaries to process an archive, establishing a baseline parent-child relationship useful for correlating subsequent suspicious child processes or file writes indicative of exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MELSOFT Update Manager Spawning 7-Zip Extraction Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: MELSOFT
Image|endswith:
- \\7z.exe
- \\7zFM.exe
- \\7zG.exe
condition: selection
falsepositives:
- Normal MELSOFT Update Manager update or package extraction workflows using the bundled
7-Zip component
level: low
tags:
- attack.t1204.002
- attack.execution
id: d8bec5cd-59a0-5e44-a89a-613d0df97218
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free