# Mitsubishi MELSOFT flaws enable code execution via 7-Zip

Published: 2026-06-30 · Severity: medium · Sectors: manufacturing
Canonical: https://vorant.io/reports/c39464ae-49ef-5b42-a7de-8fbffb68e9e9/mitsubishi-melsoft-flaws-enable-code-execution-via-7-zip

> Four vulnerabilities in Mitsubishi Electric MELSOFT Update Manager's 7-Zip component allow local attackers to execute code, cause DoS, or tamper with data via crafted archives.

CISA has issued an advisory for Mitsubishi Electric's MELSOFT Update Manager SW1DND-UDM-M, disclosing four vulnerabilities in its bundled 7-Zip component affecting versions 1.000A through 1.014Q. The flaws include a heap-based buffer overflow (CVE-2025-53816), a NULL pointer dereference (CVE-2025-53817), a link following vulnerability (CVE-2025-55188), and a path traversal issue (CVE-2025-11001). These vulnerabilities require local access and user interaction — specifically, convincing a legitimate user to decompress a specially crafted archive file.

Successful exploitation could result in arbitrary code execution, denial-of-service conditions, or information tampering and destruction. The path traversal vulnerability is the most severe, enabling code execution that could lead to information theft, system compromise, or operational disruption. The product is deployed worldwide in critical manufacturing environments.

Mitsubishi Electric has released version 1.015R to address all four vulnerabilities. For organizations unable to patch immediately, the vendor recommends layered mitigations including network segmentation, restricting physical access, blocking untrusted remote access, enforcing user awareness around email attachments, and deploying antivirus software. CISA notes that no public exploitation has been reported and the vulnerabilities are not remotely exploitable.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11001 (poc), CVE-2025-53816, CVE-2025-53817, CVE-2025-55188

## Detection guidance (public sample)

### Suspicious Child Process Spawned by 7-Zip Extraction Utility

ATT&CK: T1204.002

Detects a process spawned by 7-Zip components (as bundled with MELSOFT Update Manager) launching a script host or command interpreter shortly after archive extraction, consistent with code execution via a crafted archive exploiting a 7-Zip vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by 7-Zip Extraction Utility
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\7z.exe
    - \\7zFM.exe
    - \\7zG.exe
  filter:
    Image|endswith:
    - \\7z.exe
    - \\7zFM.exe
    - \\7zG.exe
    - \\explorer.exe
  suspicious_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\rundll32.exe
    - \\mshta.exe
    - \\regsvr32.exe
  condition: selection and suspicious_child and not filter
falsepositives:
- Users manually running scripts or command tools immediately after using 7-Zip for
  legitimate archive management
- Automated build or deployment pipelines invoking 7-Zip followed by scripted post-extraction
  steps
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 8561f4c7-56c9-5803-9bc0-a4a440c29bae
status: experimental
author: Vorant
```

### Archive Extraction Writing Files Outside Target Directory (Path Traversal)

ATT&CK: T1204.002

Detects file creation events where an extracted file path contains directory traversal sequences, indicative of exploitation of the 7-Zip path traversal vulnerability (CVE-2025-11001) bundled in MELSOFT Update Manager when a user opens a crafted archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Archive Extraction Writing Files Outside Target Directory
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \\7z.exe
    - \\7zFM.exe
    - \\7zG.exe
  traversal:
    TargetFilename|contains:
    - ..\\
    - ../
  condition: selection and traversal
falsepositives:
- Legitimate archives that intentionally contain relative path entries within an expected
  subdirectory structure (rare with well-formed archives)
level: high
tags:
- attack.t1204.002
- attack.execution
id: f2da3764-2b37-55cb-bc5d-2ae52396b0b1
status: experimental
author: Vorant
```

### MELSOFT Update Manager Spawning 7-Zip Extraction Process

ATT&CK: T1204.002

Detects MELSOFT Update Manager launching bundled 7-Zip binaries to process an archive, establishing a baseline parent-child relationship useful for correlating subsequent suspicious child processes or file writes indicative of exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MELSOFT Update Manager Spawning 7-Zip Extraction Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: MELSOFT
    Image|endswith:
    - \\7z.exe
    - \\7zFM.exe
    - \\7zG.exe
  condition: selection
falsepositives:
- Normal MELSOFT Update Manager update or package extraction workflows using the bundled
  7-Zip component
level: low
tags:
- attack.t1204.002
- attack.execution
id: d8bec5cd-59a0-5e44-a89a-613d0df97218
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c39464ae-49ef-5b42-a7de-8fbffb68e9e9/mitsubishi-melsoft-flaws-enable-code-execution-via-7-zip.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup