Mitsubishi Electric MELSOFT Update Manager (Update B)

An attacker with local access to an engineering workstation running MELSOFT Update Manager could execute arbitrary code, potentially compromising the ability to manage and deploy firmware updates to Mitsubishi control systems. This could lead to unauthorized changes to production systems or inability to apply legitimate security patches.

Organizations in the energy sector using Mitsubishi Electric control systems should review their engineering workstation inventory. Specifically, any technician or operations engineer who runs MELSOFT Update Manager to deploy firmware updates to programmable logic controllers (PLCs), inverters, or other Mitsubishi automation equipment is at risk. This is critical for organizations managing generation, transmission, or distribution systems.

An attacker with local access to a PC running vulnerable MELSOFT Update Manager (versions 1.000A–1.012N) exploits an integer underflow vulnerability while the user is interacting with the application. The attacker executes arbitrary code with the privileges of the logged-in user, which typically includes engineering workstation credentials. From there, the attacker could modify firmware packages or intercept update communications to deployed control systems.