CVE-2025-11009

mediumpriority · track · 0OT risk · elevatedEPSS 0.001 · 1 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.09% (1st) EPSS
CVSS 5.1 · medium
Is it mine?
6 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designer3 Version1 (GOT1000) all versions allows a local unauthenticated attacker to obtain plaintext credentials from the project file for GT Designer3. This could allow the attacker to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationGT Designer3 Version1 (GOT1000)cisa_csaf_ot

    Don't open untrusted files or click untrusted links.

  • MitigationGT Designer3 Version1 (GOT2000)cisa_csaf_ot

    Don't open untrusted files or click untrusted links.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.1mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · CISA US
v3.15.1mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU
v3.15.1mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpexploitability 1.4 · impact 3.6
v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-312USCWE-312US
05

affected products (6)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-25-350-04Mitsubishi Electric GT Designer32025-12-16icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an attacker obtain plaintext credentials from the project file for GT Designer3, which could result in illegally operating GOT2000 and GOT1000 series devices.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2025-12-17modified 2026-06-17
09

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan