Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-10089— Malicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S

Quick assessment

Affected
Mitsubishi Electric Corporation MILCO.S Setting Application
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mitsubishi Electric MILCO.S Setting Application和Mitsubishi Electric MILCO.S Easy Switch Application都是日本三菱电机（Mitsubishi Electric）公司的产品。Mitsubishi Electric MILCO.S Setting Application是一个照明控制系统的配套软件。Mitsubishi Electric MILCO.S Easy Switch Application是一个开关控制软

CVSS 7.7 · High EPSS 0.14% · P3
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-10089

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Malicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对搜索路径元素未加控制
Source: CVE Program / CVE List V5
Vulnerability Title
Mitsubishi Electric多款产品 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric MILCO.S Setting Application和Mitsubishi Electric MILCO.S Easy Switch Application都是日本三菱电机（Mitsubishi Electric）公司的产品。Mitsubishi Electric MILCO.S Setting Application是一个照明控制系统的配套软件。Mitsubishi Electric MILCO.S Easy Switch Application是一个开关控制软
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mitsubishi Electric Corporation MILCO.S Setting Application All versions -
Mitsubishi Electric Corporation MILCO.S Setting Application (IR) All versions -
Mitsubishi Electric Corporation MILCO.S Easy Setting Application (IR) All versions -
Mitsubishi Electric Corporation MILCO.S Easy Switch Application (IR) All versions -

II. Public POCs for CVE-2025-10089

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-10089

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: Mitsubishi Electric Corporation
Same weakness: CWE-427

V. Comments for CVE-2025-10089

No comments yet

Leave a comment