Mitsubishi Electric MILCO.S Setting Application MILCO.S Lighting Control.exe uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mitsubishi Electric MILCO.S Setting Application, MILCO.S Easy Setting Application and MILCO.S Easy Switch Application. The affected element is an unknown function of the file MILCO.S Lighting Control.exe. This manipulation causes uncontrolled search path. This vulnerability is tracked as CVE-2025-10089. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Mitsubishi Electric MILCO.S Setting Application, MILCO.S Easy Setting Application and MILCO.S Easy Switch Application (affected version unknown). Affected by this vulnerability is an unknown functionality of the file MILCO.S Lighting Control.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced.

It is possible to read the advisory at mitsubishielectric.com. This vulnerability is known as CVE-2025-10089 since 09/08/2025. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Mitsubishi Electric

Name

• MILCO.S Easy Setting Application
• MILCO.S Easy Switch Application
• MILCO.S Setting Application

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion