CVE-2025-5514
BaseFortify
Publication date: 2025-08-25
Last updated on: 2025-08-25
Assigner: Mitsubishi Electric Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitsubishi | electric_melsec_iq-f | fx5u |
| mitsubishi | electric_melsec_iq-f | fx5uc |
| mitsubishi | electric_melsec_iq-f | 1.060 |
| mitsubishi | electric_melsec_iq-f | fx5s |
| mitsubishi | electric_melsec_iq-f | fx5uj |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-130 | The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper handling of length parameter inconsistency in the web server function of Mitsubishi Electric's MELSEC iQ-F Series CPU modules. Specifically, when the web server processes specially crafted HTTP requests with malformed length parameters, it fails to handle them correctly, which can disrupt normal service operation and cause a denial-of-service (DoS) condition. [1]
How can this vulnerability impact me? :
The vulnerability allows a remote unauthenticated attacker to delay the processing of the web server function and prevent legitimate users from utilizing it. This results in a denial-of-service (DoS) condition, meaning the affected web server becomes unavailable or unresponsive, impacting availability of the service. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves sending specially crafted HTTP requests with malformed length parameters to the MELSEC iQ-F Series CPU module's web server function. Detection can be attempted by monitoring network traffic for unusual or malformed HTTP requests targeting the affected devices. Specific commands or tools are not provided in the available resources. Users should verify affected product models and firmware versions as part of detection efforts. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no fixed firmware update is planned, immediate mitigation involves applying the mitigation and workaround measures recommended by Mitsubishi Electric Corporation as detailed in their guidance. Users should consult official advisories from Mitsubishi Electric and JPCERT/CC for specific mitigation steps. Additionally, monitoring and restricting access to the web server function on affected MELSEC iQ-F Series CPU modules can help reduce risk. [1]