Overview
CVE-2025-3784 describes a medium severity vulnerability affecting all versions of GX Works2, a software suite used for programming Mitsubishi Electric programmable logic controllers (PLCs). The vulnerability stems from the cleartext storage of sensitive information, specifically user credentials, within project files. This allows an attacker to potentially extract these credentials and gain unauthorized access to protected project files, leading to the modification or theft of sensitive data.
Technical Details
The core issue lies in how GX Works2 stores authentication credentials. Instead of employing encryption or hashing techniques, the software saves these credentials in plaintext within project files. An attacker who obtains a project file can analyze it and easily extract the username and password. This can be achieved through various means, such as:
- Intercepting network traffic if the project file is transmitted without encryption.
- Gaining unauthorized access to a system where project files are stored.
- Social engineering to trick a user into sharing a project file.
CVSS Analysis
The vulnerability has been assigned a CVSS score of 5.5 (Medium). This score reflects the potential impact and exploitability of the vulnerability. While the attack requires local access to the project file or its transmission, the ease of extracting the credentials significantly increases the risk. The CVSS vector string associated with this score would likely include components reflecting the confidentiality impact, integrity impact, and availability impact depending on the specific exploitation scenario.
Possible Impact
Successful exploitation of CVE-2025-3784 can have significant consequences:
- Unauthorized Access: Attackers can bypass user authentication and open project files that are supposed to be protected.
- Data Theft: Sensitive project information, including proprietary algorithms and configurations, can be stolen.
- Malicious Modification: Attackers can modify PLC programs, potentially causing equipment damage, process disruptions, or even safety hazards.
- Denial of Service: Modifications could render the PLC inoperable.
Mitigation and Patch Steps
Mitsubishi Electric has addressed this vulnerability. Users are strongly advised to take the following steps:
- Apply the Patch: Upgrade GX Works2 to the latest version. Refer to the official Mitsubishi Electric security advisory for detailed instructions and download links.
- Access Control: Implement strict access control measures to limit who can access project files.
- Network Security: Ensure that network traffic related to GX Works2 and project file transfers is encrypted (e.g., using VPNs).
- Security Awareness Training: Educate users about the risks of sharing project files and the importance of secure storage practices.
