CVE-2025-0921Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric BizViz all versions, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS versions 11.00, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95, Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions, Mitsubishi Electric Iconics Digital Solutions BizViz all versions, and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.

Back to dashboard

0.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-250

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Patch or workaround signal is available
22 mentions across 8 observed days
Momentum state: declining

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 15 signals
Disclosure: 16 classified signals
General: 3 classified signals
Peaked 7d ago at 10 mentions (2026-01-31); latest day: 1
22 total mentions across 8 days

Deep dive

Activity timeline22 mentions / 8d

Signal classification3 categories

Disclosure

1672.7%

General

313.6%

Patch

313.6%

Referenced assets28 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-31	10	Disclosure8General1Patch1
2026-02-01	2	Disclosure1Patch1
2026-02-02	3	Disclosure2General1
2026-02-03	3	Disclosure3
2026-02-11	1	General1
2026-02-19	1	Disclosure1
2026-03-05	1	Disclosure1
2026-04-08	1	Patch1

Full discourse20 posts

Unit 42@Unit42_Intel250d
Disclosure
We identified CVE-2025-0921 in Iconics Suite, a supervisory control and data acquisition (SCADA) system. Successful exploitation may lead to a denial-of-service attack. Understand how privileged file system vulns are pertinent to an OT context: https://bit.ly/3NNQMsi https://t.co/bwqlRCbMGV
Post summary
The post announces the discovery of CVE‑2025‑0921 in Iconics Suite and notes its potential for a denial‑of‑service attack, but offers no PoC, patch, or evidence of active exploitation.
015033155.1K
66.6K followersView on X
Nicolas Krassas@Dinosn252d
Disclosure
Privileged File System Vulnerability Present in a SCADA System https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
The text announces a privileged file system vulnerability in an Iconics Suite SCADA system (CVE‑2025‑0921), providing its CVE identifier but without any PoC, exploit, or patch information, and it does not indicate active exploitation.
0301592.0K
151.4K followersView on X
Cyber_OSINT@Cyber_O51NT252d
Disclosure
Unit 42 detailed CVE-2025-0921, a privileged file system flaw in the Iconics Suite SCADA system, which could cause a DoS attack. https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
Unit 42 details CVE‑2025‑0921, a privileged‑file‑system flaw in the Iconics Suite SCADA system that can trigger a denial‑of‑service attack.
140131940
21.3K followersView on X
Unit 42 Japan@unit42_jp233d
Disclosure
CVE-2025-0921 は、監視制御およびデータ収集（SCADA）システムである Iconics Suite で確認されました。悪用に成功すると、サービス拒否攻撃につながる可能性があります。詳しくはこちら: https://bit.ly/4qOn9oC https://t.co/VTB3ti5KDC
Post summary
CVE-2025-0921 has been disclosed for Iconics Suite SCADA, with the potential to cause a denial‑of‑service if successfully exploited.
03051850
2.7K followersView on X
ctrlaltnod@ctrlaltnod252d
Disclosure
Critical SCADA Flaw CVE-2025-0921 Hits Global Industrial Systems Critical SCADA vulnerability CVE-2025-0921 exposes global industrial systems ... #CyberSecurity https://www.ctrlaltnod.com/news/critical-scada-flaw-cve-2025-0921-hits-global-industrial-systems/
Post summary
An announcement highlights the discovery of a critical SCADA vulnerability (CVE‑2025‑0921) affecting global industrial systems, but it provides no PoC, exploit details, patches, or technical specifics.
12041425
188 followersView on X
Grok@grok241d
General
Not necessarily—while AI risks like SCADA hacks (e.g., 2025 CVE-2025-0921 vulnerability) are real and escalating per recent reports, the International AI Safety Report 2026 and NIST guidelines emphasize robust defenses, ethical AI, and human oversight to avert catastrophe. It's about proactive balance, not inevitability. What steps do you think could help most?
Post summary
The post briefly references CVE-2025-0921 in the context of AI risk but offers no concrete details about the vulnerability, exploitation, or mitigation.
3000053
8.1M followersView on X
Dr.Mashari@GMashari249d
Disclosure
🛡️ التقرير الأسبوعي للأحداث السيبرانية – ثغرة في نظام ملفات ذي امتيازات عالية تؤثر على نظام SCADA: Iconics Suite ⚠️ الفئة: ثغرة 📝 ملخص الحادثة: يتناول هذا التقرير اكتشاف ثغرة أمنية حرجة جديدة تحمل المعرّف CVE-2025-0921. تكمن هذه الثغرة في خلل بنظام الملفات ذي الامتيازات العالية (Privileged File System) ضمن نظام SCADA، وتحديداً في حزمة Iconics Suite. يمكن استغلال هذا الخلل لإطلاق هجمات حرمان من الخدمة (DoS)، مما قد يؤدي إلى تعطيل العمليات الحيوية في الأنظمة الصناعية والتحكمية التي تعتمد على SCADA. تُعد أنظمة SCADA مكوناً أساسياً وحيوياً في البنى التحتية الحساسة، ولذلك فإن أي ثغرة فيها، خاصة تلك التي تهدد بتعطيل الخدمة بالكامل، تحمل أهمية بالغة وتداعيات محتملة خطيرة على استمرارية العمليات وسلامة الأنظمة والأفراد. يمكن أن يؤدي هذا النوع من الهجمات إلى خسائر تشغيلية واقتصادية كبيرة، بالإضافة إلى تعطيل الخدمات الأساسية. لم يذكر التقرير في الملخص المبدئي أي توصيات محددة أو إجراءات استجابة فورية لمعالجة هذه الثغرة، ولكن من المتوقع أن تتضمن معالجة مثل هذه الثغرات الحساسة إصدار تحديثات أمنية وتطبيق تصحيحات برمجية من قبل الجهة المطوّرة. 📅 تاريخ النشر: 30/01/2026 🔗 المصدر: https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
CVE‑2025‑0921 is a privileged file system vulnerability in Iconics Suite SCADA that can trigger DoS attacks. No PoC, exploit, or active exploitation is reported; patching is expected.
0002097
9.3K followersView on X
Asher Davila@Asher_Davila249d
Disclosure
We just published the second part of our research on the Mitsubishi ICONICS Suite, an industrial software platform widely used for SCADA. In this research, we identified vulnerabilities in the Mitsubishi ICONICS Suite to Escalate Privileges: https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
The post announces research uncovering privilege‑escalation vulnerabilities in Mitsubishi ICONICS Suite, citing CVE‑2025‑0921.
1001098
1.2K followersView on X
Cyber Research@Cyb3rR3s34rch252d
Disclosure
Originally from Unit 42: Privileged File System Vulnerability Present in a SCADA System https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ ( :-{ı▓ #unit42 #threathunting #cyberresearch https://t.co/PbsRSmhnuB
Post summary
Tweet shares link to Unit 42 article announcing a privileged file system vulnerability in an Iconics SCADA system.
0101053
52 followersView on X
Syed Aquib@syedaquib77186d
Patch
⚠️ **Vulnerability Alert:** CISA ICS Advisory: Mitsubishi Electric GENESIS64 and ICONICS Suite products (multiple ICS advisories/updates) 📅 **Timeline:** Disclosure: 2026-04-07, Patch: Multiple (see references) 🆔 **CVE-2025-14815** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: Not Available 🆔 **CVE-2025-14816** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: Not Available 🆔 **CVE-2025-7376** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 1.456% 🆔 **CVE-2025-0921** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 20.714% 🆔 **CVE-2024-8299** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 6.927% 🆔 **CVE-2024-8300** | 📊 CVSS: 7.0 (HIGH 🟠) | 📈 EPSS: 10.572% 🆔 **CVE-2024-9852** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 6.927% 🆔 **CVE-2023-2650** | 📊 CVSS: 3.7 (LOW 🟢) | 📈 EPSS: 99.698% 🆔 **CVE-2023-4807** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 74.338% 🆔 **CVE-2024-1182** | 📊 CVSS: 7.0 (HIGH 🟠) | 📈 EPSS: 18.210% 🆔 **CVE-2024-1573** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 47.466% 🆔 **CVE-2024-1574** | 📊 CVSS: 6.7 (MEDIUM 🟡) | 📈 EPSS: 34.105% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX <=10.97.3, MC Works64 — all versions, GENESIS <=11.03 (varies by advisory), IoTWorX 10.95, GENESIS32/BizViz — various versions 🔧 **Fixed Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX: 10.98+, GENESIS: 11.01 / 11.03+, IoTWorX: 10.96+, No fix for MC Works64/GENESIS32/BizViz — vendor mitigations 🫨 **Attack Vectors:** - Local attacker / local access required - Cleartext storage of SQL credentials in local SQLite cache and plaintext display in GUI - Windows .LNK/symbolic-link exploitation enabling arbitrary writes - DLL search-path/DLL planting (uncontrolled search path) - OpenSSL parsing via BACnet Secure Connect (remote malformed cert/MAC) - Authentication bypass via AD + automatic logon conditions - Execution with unnecessary privileges / unsafe reflection 📝 **Summary:** Multiple local (and some remote) vulnerabilities across Mitsubishi/ICONICS ICS products expose plaintext SQL credentials, enable arbitrary file writes and DLL planting, and allow authentication bypass or unsafe code execution paths. Impacts include credential disclosure, tampering, denial-of-service, and, in some cases, elevated arbitrary code execution — patch immediately where available and apply mitigations for unpatchable products. 📈 **Impact Scope:** Affects multiple Mitsubishi Electric / ICONICS products used in critical manufacturing ICS: credential disclosure, information disclosure, arbitrary file tampering/deletion, DoS, and potential code execution with elevated privileges. 🛡️ **Recommended Actions:** - Apply vendor-supplied patches immediately; isolate ICS networks, restrict remote/admin logins and enforce least privilege. - Disable/delete local cache (C:\ProgramData\ICONICS\Cache\*.sdf and C:\ProgramData\ICONICS\11\Cache\*.sqlite3), prefer Windows auth for SQL Server, harden HHSplitter.exe, and follow vendor mitigations for unpatched products. 🪢 **Related Resources:** - https://www.youtube.com/watch?v=KsZ6tROaVOQ - https://en.wikipedia.org/wiki/2 🏷 **Tags:** #Cybersecurity #ICS #MitsubishiElectric
Post summary
The alert announces multiple high‑severity vulnerabilities in Mitsubishi Electric and ICONICS products, details local attack vectors and credential exposure, and urges immediate patching along with recommended mitigations.
00000111
276 followersView on X
Larry Irvin@cu1993219d
Disclosure
Unit 42 identified CVE-2025-0921 in Iconics Suite, a supervisory control and data acquisition (SCADA) system. Successful exploitation may lead to a denial-of-service attack. Understand how privileged file system vulns are pertinent to an OT context: https://sprou.tt/1I91bPlnMJT
Post summary
Unit 42 has identified a new CVE-2025-0921 vulnerability in Iconics Suite that could lead to a denial-of-service attack. No PoC, exploit, active exploitation, patch, or false-positive claim is provided.
0000077
289 followersView on X
Lorenzo H. Gomez@lgomezperu249d
Disclosure
Privileged File System Vulnerability Present in a SCADA System https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
Unit 42 highlights the discovery of a privileged file system vulnerability (CVE‑2025‑0921) in Iconics SCADA systems.
0000032
1.2K followersView on X
DCI CyberSec News@DCICyberSecNews250d
General
Privileged File System Vulnerability Present in a SCADA System https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ --via Cyware Social
Post summary
The text merely announces a SCADA system vulnerability and links to a blog post, providing no further technical or actionable details.
0000046
2.1K followersView on X
Machina Record@MachinaRecord250d
Disclosure
【リンク集：1月30日〜2月2日のセキュリティ関連ニュース/記事】＜脆弱性＞・三菱電機のSCADAシステムに特権ファイルシステムの脆弱性が見つかる（CVE-2025-0921） https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ ＜マルウェア・その他脅威＞・eScanアンチウイルス、サプライチェーン攻撃受けマルウェアを拡散 https://www.securityweek.com/escan-antivirus-delivers-malware-in-supply-chain-attack/ ＜AI関連＞・オープンソースAI、世界規模でセキュリティの大問題に発展する恐れ　研究者が指摘 https://www.theregister.com/2026/02/01/opensource_ai_is_a_global/ ・Ollamaの無防備なホスト17万5,000件が発見される　高まるLLM悪用の可能性 https://www.securityweek.com/175000-exposed-ollama-hosts-could-enable-llm-abuse/ ＜サイバー戦/APT/国家型アクター/地政学関連＞・ロシアの関与疑われるポーランド電力網への攻撃で、ICSデバイスの一部が機能停止に https://www.securityweek.com/ics-devices-bricked-in-russia-linked-strike-on-polish-power-grid/ ・イラン関与のサイバーキャンペーン「RedKitten」、人権NGOや活動家を攻撃 https://thehackernews.com/2026/01/iran-linked-redkitten-cyber-campaign.html ・中国系アクターUAT-8099、BadIIS SEOマルウェアでアジアのIISサーバーを標的に https://thehackernews.com/2026/01/china-linked-uat-8099-targets-iis.html ＜逮捕/テイクダウン/制裁/違反/その他法執行関連＞・元Googleエンジニア、AIに関する企業秘密を窃取した罪で有罪判決 https://www.helpnetsecurity.com/2026/01/30/ex-google-engineer-espionage/ ・各法執行機関が連携し、複数の大手海賊版テレビストリーミングサービスを解体 https://www.bleepingcomputer.com/news/legal/operation-switch-off-dismantles-major-pirate-tv-streaming-services/ ・ジェフリー・エプスタインに「個人的なハッカー」の存在　FBIへの情報提供者が証言 https://techcrunch.com/2026/01/30/informant-told-fbi-that-jeffrey-epstein-had-a-personal-hacker/ ＜プライバシー＞・プライバシーへの懸念が高まる中、ウェアラブルデバイスの導入進む https://www.helpnetsecurity.com/2026/01/30/wearable-data-privacy-tech/ ・Appleの新たなプライバシー機能　通信事業者による位置情報追跡の精度を制限 https://www.helpnetsecurity.com/2026/01/30/apple-limit-precise-location-ios/ ＜リサーチ/攻撃手法/TTP＞・Instagramの非公開アカウントから写真流出、研究者が証拠を公開 https://www.bleepingcomputer.com/news/security/researcher-reveals-evidence-of-private-instagram-profiles-leaking-photos/ ・Mandiant、SSOを悪用してクラウドデータを盗むShinyHuntersの手口を詳述 https://www.bleepingcomputer.com/news/security/mandiant-details-how-shinyhunters-abuse-sso-to-steal-cloud-data/ ・クラウドストレージ料金詐欺、偽の更新通知メールを大量送信 https://www.bleepingcomputer.com/news/security/cloud-storage-payment-scam-floods-inboxes-with-fake-renewals/ ・Pulsar RATを利用するWindowsマルウェア攻撃、ライブチャット中にデータ窃取 https://hackread.com/windows-malware-pulsar-rat-live-chats-steal-data/ ・Open VSXの開発者アカウントが侵害され、GlassWormローダーを拡散 https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise ・MongoDBの公開インスタンス、今なおデータ脅迫攻撃の標的に https://www.bleepingcomputer.com/news/security/exposed-mongodb-instances-still-targeted-in-data-extortion-attacks/ ＜その他＞・マイクロソフト、WindowsのNTLM認証を将来的にデフォルトで無効化 https://www.bleepingcomputer.com/news/microsoft/microsoft-to-disable-ntlm-by-default-in-future-windows-releases/ ・2025年に暗号資産ウォレットへ流入した不正資金、過去最高の1,580億ドルに https://www.bleepingcomputer.com/news/security/crypto-wallets-received-a-record-158-billion-in-illicit-funds-last-year/
Post summary
A privilege escalation vulnerability (CVE-2025-0921) was identified in Mitsubishi Electric’s SCADA system, reported via a Unit42 link. No PoC, exploit code, active exploitation, patch, or detailed technical information is provided.
00000330
1.2K followersView on X
OneData131@OneData131251d
Disclosure
Privileged File System Vulnerability Present in a SCADA System Severity: MEDIUM https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ #CyberSecurity #ThreatIntel https://t.co/OW7Z2YYUBo
Post summary
The tweet announces a medium‑severity privileged file system vulnerability (CVE‑2025‑0921) in a SCADA system and links to a Unit 42 article, but offers no further technical details or actionable information.
0000061
4 followersView on X
The Daily Tech Feed@dailytechonx251d
Patch
Alert: A new SCADA vulnerability (CVE-2025-0921) could lead to DoS attacks in industrial systems. Ensure your systems are patched and secure. Link: https://thedailytechfeed.com/scada-vulnerability-in-iconics-suite-risks-industrial-dos-attacks-mitsubishi-releases-patches/ #Vulnerability #Security #SCADA #Cyber #Patch #Industrial #DoS #Systems #Mitigation #Threat #Technology #Protection #Safety #Network #Risk #Update #Software #Defense #Breach #Alert
Post summary
CVE‑2025‑0921 is a newly disclosed SCADA vulnerability that can cause DoS attacks; patches have been released and users are advised to update their systems promptly.
0000071
238 followersView on X
Hannah Genie@hm_tech_travel252d
General
@Cyber_O51NT CVE-2025-0921 is a real wake-up call! Reminds me why I stay sharp with cybersecurity certs. UAE keeps raising the bar in OT security every year. 🔒
Post summary
The tweet merely names CVE-2025-0921 and encourages vigilance, but provides no technical or actionable information.
0000053
32 followersView on X
Todd Pigram@pigram86252d
Disclosure
Privileged File System Vulnerability Present in a SCADA System https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
Post summary
The linked article announces a privileged file system vulnerability (CVE‑2025‑0921) discovered in Iconics Suite SCADA systems, with no details on exploitation or patching available in the provided text.
0000043
1.4K followersView on X
趣テクノロジー@omomuki_tech252d
Disclosure
SCADAシステムであるIconics Suiteに、サービス拒否(DoS)を引き起こす可能性がある中程度の深刻度の脆弱性（CVE-2025-0921）が発見されました。この脆弱性は、自動車、エネルギー、製造業などの幅広い分野で導入されている監督制御・データ収集インフラに影響を与える可能性があります。この脆弱性の原因は、三菱電機製の複数のサービスが不要な権限で実行されることにあります。攻撃者がこれを悪用すると、重要な産業用制御システムを停止させ、産業オペレーションを混乱させるサービス拒否状態を引き起こす可能性があります。 #セキュリティ #脆弱性 #SCADA https://cybersecuritynews.com/scada-vulnerability-triggers-dos/
Post summary
An DoS vulnerability (CVE‑2025‑0921) affecting Iconics Suite SCADA systems was identified, with moderate severity and a root cause tied to improperly privileged Mitsubishi Electric services.
0000046
242 followersView on X
PurpleOps@PurpleOps_io252d
Disclosure
🚨 𝐏𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐝 𝐅𝐢𝐥𝐞 𝐒𝐲𝐬𝐭𝐞𝐦 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐏𝐫𝐞𝐬𝐞𝐧𝐭 𝐢𝐧 𝐚 𝐒𝐂𝐀𝐃𝐀 𝐒𝐲𝐬𝐭𝐞𝐦 • A vulnerability (CVE-2025-0921, CVSS 6.5) impacts Iconics Suite, a SCADA system for industrial processes. • Attackers can misuse privileged file system operations to corrupt critical system binaries. • Successful exploitation of this flaw can create a denial-of-service condition on affected systems. A vulnerability in Iconics Suite's file system operations permits attackers to corrupt system binaries, leading to denial of service in industrial control environments.
Post summary
This message announces the discovery of CVE-2025-0921, a denial‑of‑service vulnerability in Iconics Suite caused by privileged file system operations that could corrupt critical binaries.
0000088
64 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2025-0921

Nicolas Krassas[verified]@DinosnDisclosure

The text announces a privileged file system vulnerability in an Iconics Suite SCADA system (CVE‑2025‑0921), providing its CVE identifier but without any PoC, exploit, or patch information, and it does not indicate active exploitation.

ctrlaltnod[verified]@ctrlaltnodDisclosure

An announcement highlights the discovery of a critical SCADA vulnerability (CVE‑2025‑0921) affecting global industrial systems, but it provides no PoC, exploit details, patches, or technical specifics.

Grok[verified]@grokGeneral

The post briefly references CVE-2025-0921 in the context of AI risk but offers no concrete details about the vulnerability, exploitation, or mitigation.

Dr.Mashari[verified]@GMashariDisclosure

CVE‑2025‑0921 is a privileged file system vulnerability in Iconics Suite SCADA that can trigger DoS attacks. No PoC, exploit, or active exploitation is reported; patching is expected.

Syed Aquib[verified]@syedaquib77Patch

The alert announces multiple high‑severity vulnerabilities in Mitsubishi Electric and ICONICS products, details local attack vectors and credential exposure, and urges immediate patching along with recommended mitigations.

Machina Record[verified]@MachinaRecordDisclosure

A privilege escalation vulnerability (CVE-2025-0921) was identified in Mitsubishi Electric’s SCADA system, reported via a Unit42 link. No PoC, exploit code, active exploitation, patch, or detailed technical information is provided.

The Daily Tech Feed[verified]@dailytechonxPatch

CVE‑2025‑0921 is a newly disclosed SCADA vulnerability that can cause DoS attacks; patches have been released and users are advised to update their systems promptly.

Todd Pigram[verified]@pigram86Disclosure

The linked article announces a privileged file system vulnerability (CVE‑2025‑0921) discovered in Iconics Suite SCADA systems, with no details on exploitation or patching available in the provided text.