Improper Input Validation in Mitsubishi Electric's MELSEC iQ-F Series CPU Modules
CVE-2025-3755

9.1CRITICAL

Key Information:

Vendor

Mitsubishi Electric Corporation

Status
Melsec Iq-f Series Fx5u-32mt/es
Melsec Iq-f Series Fx5u-32mt/ds
Melsec Iq-f Series Fx5u-32mt/ess
Melsec Iq-f Series Fx5u-32mt/dss
Vendor
CVE Published:
29 May 2025

What is CVE-2025-3755?

An input vulnerability in Mitsubishi Electric's MELSEC iQ-F Series CPU modules allows a remote attacker to exploit improper validation of specified index, position, or offset. This can lead to unauthorized data retrieval and can cause a Denial-of-Service condition by sending specially crafted packets. The affected CPU modules may require a reset for recovery after being impacted.

Affected Version(s)

MELSEC iQ-F Series FX5S-30MR/DS All versions

MELSEC iQ-F Series FX5S-30MR/ES All versions

MELSEC iQ-F Series FX5S-30MT/DS All versions

References

https://www.mitsubishielectric.com/psirt/vulnerability/pd...
vendor-advisory
https://jvn.jp/vu/JVNVU94070048/
government-resource

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.