CVE-2025-7405

Published: Sep 1, 2025Modified: Jun 17, 2026Deferred

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Secondary)

Description

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://jvn.jp/vu/JVNVU90041458/

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-01

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-011_en.pdf

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Timeline

No history available yet.