CVE-2025-5023
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-09-19
Assigner: Mitsubishi Electric Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitsubishi | electric | eco_guidetab |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the use of hard-coded credentials in Mitsubishi Electric's photovoltaic system monitor EcoGuideTAB models PV-DR004J and PV-DR004JA. An attacker within Wi-Fi range between the measurement and display units can exploit these hardcoded user ID and password credentials (which are common across the product series) to access sensitive information such as generated power and electricity sold back to the grid. The attacker can also tamper with or destroy stored or configured information or cause a Denial-of-Service (DoS) condition on the product. The vulnerability is not exploitable when the product enters power-saving mode after 5 minutes of inactivity with the display unit's LCD off. These affected products were discontinued in 2015 and support ended in 2020.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to disclose sensitive operational data such as power generation and electricity sales, tamper with or destroy stored or configured information on the photovoltaic system monitor, or cause a Denial-of-Service (DoS) condition, potentially disrupting the monitoring and management of the photovoltaic system.
What immediate steps should I take to mitigate this vulnerability?
Since the vulnerability involves hard-coded credentials exploitable within Wi-Fi communication range, immediate mitigation steps include limiting physical and wireless access to the affected devices, disabling or restricting Wi-Fi communication if possible, and ensuring the product enters power-saving mode by leaving it unused for at least 5 minutes to reduce exposure. Note that the affected products were discontinued in 2015 and support ended in 2020, so consider replacing them with supported devices.