CVE-2025-3128

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-312807.8A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafte CVE-2025-312819.1An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, CVE-2025-312827.2A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrat CVE-2025-312837.2A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator CVE-2025-312847.2A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to CVE-2025-312857.2A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator CVE-2025-312869.0An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. CVE-2025-31294.8Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access c CVE-2025-31305.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.Thi CVE-2025-31315.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affec CVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload poten CVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciou