CVE-2025-7405

Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module

Published Sep 1, 2025 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-26324 Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Mitsubishi Electric
Mitsubishi Electric melsec Iq-f Series
Vendors & Products Mitsubishi Electric
Mitsubishi Electric melsec Iq-f Series
Type Values Removed Values Added
Description Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.
Title Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Mitsubishi
Published
Updated
Sep 2, 2025, 7:27 PM
Reserved
Jul 10, 2025, 5:59 AM
Status
Deferred
Published
Sep 1, 2025, 4:15 AM
Modified
Jun 17, 2026, 10:04 AM