CVE-2025-10089 - CVE House

Back to Database

Status published High CVE-2025-10089

Malicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S

7.7 CVSS

Vulnerability Description

Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10089

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Mitsubishi Electric Corporation

View All →

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric...

Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module

Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module

Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS

Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module

Affected Vendor

Mitsubishi Electric Corporation

View all reports →

Affected Software

MILCO.S Setting Application, MILCO.S Setting Application (IR), MILCO.S Easy Setting Application (IR), MILCO.S Easy Switch Application (IR)

Vulnerable Versions:

All versions

Timeline

Official Publish: November 18th, 2025

Last Modified: November 27th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

T1574.001 DLL Search Order Hijacking

Privilege Escalation

T1547 Boot or Logon Autostart Execution

T1036 Masquerading

Defense Evasion

T1059 Command and Scripting Interpreter