What’s Vulnerable › Vulnerabilities

CVE-2024-25086

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-02 · updated 2026-06-17
• Weakness: CWE-94

Description

Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.

Affected products

• Jungo Windriver: before 12.2.0 — fixed in 12.2.0
• Mitsubishi Electric Corporation CPU Module Logging Configuration Tool: all versions
• Mitsubishi Electric CW Configurator: all versions
• Mitsubishi Electric Corporation Data Transfer: all versions
• Mitsubishi Electric Corporation Data Transfer Classic: all versions
• Mitsubishi Electric Corporation EZSocket: all versions
• Mitsubishi Electric Corporation FR Configurator2: all versions
• Mitsubishi Electric Corporation FR Configurator SW3: all versions
• Mitsubishi Electric Corporation GENESIS64: all versions
• Mitsubishielectric Gt Got1000: all versions
• Mitsubishielectric Gt Got2000: all versions
• Mitsubishielectric Gt Softgot1000: all versions
• Mitsubishi Electric Corporation GT SoftGOT2000: all versions
• Mitsubishi Electric Corporation GX Developer: all versions
• Mitsubishi Electric Corporation GX LogViewer: all versions
• Mitsubishi Electric Corporation GX Works2: all versions
• Mitsubishi Electric Corporation GX Works3: all versions
• Mitsubishielectric Iq Works: all versions
• Mitsubishi Electric MI Configurator: all versions
• Mitsubishielectric Mr Configurator: all versions
• Mitsubishi Electric MR Configurator2: all versions
• Mitsubishielectric Mrzjw3-Mc2-Utl Firmware: all versions
• Mitsubishi Electric Corporation MX Component: all versions
• Mitsubishielectric Mx Opc Server Da/Ua: all versions
• Mitsubishielectric Numerical Control Device Communication: all versions
• Mitsubishielectric Px Developer/Monitor Tool: all versions
• Mitsubishi Electric Corporation RT ToolBox3: all versions
• Mitsubishi Electric Corporation RT VisualBox: all versions
• Mitsubishielectric Sw0Dnc-Mneth-B Firmware: all versions
• Mitsubishielectric Sw1Dnc-Ccbd2-B Firmware: all versions

How to fix

Upgrade to a fixed version: Jungo Windriver 12.2.0. Check the vendor advisory for mitigations.

References

• https://jungo.com/windriver/versions/
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
• https://jungo.com/windriver/versions/
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf

Get alerted when CVE-2024-25086 or the next vulnerability affects your stack