CVE-2025-11009 - CVE House
Back to Database
Status published Medium CVE-2025-11009

Information Disclosure Vulnerability in GT Designer3

Vulnerability Description

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designer3 Version1 (GOT1000) all versions allows a local unauthenticated attacker to obtain plaintext credentials from the project file for GT Designer3. This could allow the attacker to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11009

Credits & Attribution

No credits recorded in the NVD database.

References

More from Mitsubishi Electric Corporation

View All →
CVE-2025-8531
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric...
Medium 6.8
CVE-2025-7731
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
High 7.5
CVE-2025-7405
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
High 7.3
CVE-2025-7376
Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS
Medium 5.9
CVE-2025-5514
Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module
Medium 5.3

Affected Vendor

Mitsubishi Electric Corporation

View all reports →

Affected Software

GT Designer3 Version1 (GOT2000), GT Designer3 Version1 (GOT1000)
Vulnerable Versions:
all versions

Timeline

Official Publish: December 17th, 2025
Last Modified: December 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1530 Data from Cloud Storage
Collection
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration