CISA warns of vulnerabilities in discontinued LS Electric GMWin 4 programming software
Take action: If you're using LS Electric's GMWin 4 software, be aware that it's discontinued and has serious security flaws and no patches coming. Plan to migrate to their newer XGT series. In the meantime isolate any GMWin 4 systems from network access until you can replace them and control access to them only to trusted individuals.
Learn More
CISA is reporting multiple vulnerabilities affecting LS Electric's GMWin 4 programming software, a tool widely used for configuring programmable logic controllers (PLCs) in critical manufacturing environments worldwide.
Vulbnerabilities summary
- CVE-2025-49850 (CVSS score varies from 8.4 to 9.8) - Heap-based Buffer Overflow. This flaw enables attackers to corrupt memory structures, potentially leading to complete compromise of the affected system.
- CVE-2025-49849 (CVSS score varies from 8.4 to 9.8) - Out-of-bounds Read. This flaw allows unauthorized access to memory locations beyond allocated boundaries, potentially exposing sensitive information or system configurations.
- CVE-2025-49848 (CVSS score varies from 8.4 to 9.8) - Out-of-bounds Write. It allows attackers to modify memory content in unintended locations, which could result in system instability or unauthorized code execution.
All three security flaws stem from improper validation of user-supplied data during the parsing of PRJ project files, which are integral to GMWin's core functionality. All vulnerabilities require local access to be exploited.
The vulnerabilities affect GMWin 4 version 4.18
LS Electric, headquartered in South Korea, has officially discontinued GMWin 4 and no longer provides service or support for the software. The company strongly recommends that all users migrate to their modern XGT series as a replacement solution, which offers ongoing support and active development.
