Vulnerability · Published Nov 27, 2025 · Assigned by Mitsubishi

CVE-2025-3784Information Disclosure Vulnerability in GX Works2

Medium 5.5

In plain English

A medium-severity security flaw in GX Works2 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 98.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext from project files. As a result, the attacker may be able to open project files protected by user authentication using disclosed credential information, and obtain or modify project information.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works2	All versions

Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-016_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU95288056/ government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-01 government-resource