CVE-2025-7405
BaseFortify
Publication date: 2025-09-01
Last updated on: 2025-09-02
Assigner: Mitsubishi Electric Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitsubishi | electric | melsec_iq-f_series_cpu |
| mitsubishi | electric | melsec_iq-f_series_cpu |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mitsubishi Electric's MELSEC iQ-F Series CPU modules is due to missing authentication for critical functions. It allows a remote unauthenticated attacker to read or write device values and stop program operations because the MODBUS/TCP protocol used does not have authentication features. Essentially, attackers can remotely access and manipulate the device without needing credentials. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized reading and modification of device values and can stop the operation of programs running on the affected devices. This can cause information leakage, data tampering, and denial of service (DoS), potentially disrupting industrial control processes and causing operational failures. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying Mitsubishi Electric MELSEC iQ-F Series CPU modules on the network and checking for unauthenticated MODBUS/TCP communications. Network scanning tools can be used to detect devices responding on MODBUS/TCP ports (typically port 502). Monitoring for unauthorized read/write commands or unexpected program stops on these devices may indicate exploitation attempts. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the vendor-recommended mitigation and workaround measures as no firmware updates are planned. These may involve restricting network access to the affected devices, implementing network segmentation, using firewalls to block unauthorized MODBUS/TCP traffic, and monitoring for suspicious activity. Detailed mitigation instructions are available from Mitsubishi Electric and associated ICS advisories. [1]