Overly Restrictive Account Lockout Mechanism in Mitsubishi Electric MELSEC iQ-F Series

CVE-2025-5241

What is CVE-2025-5241?

The MELSEC iQ-F Series by Mitsubishi Electric exhibits a vulnerability where an adversary can exploit an overly restrictive account lockout mechanism. A remote unauthenticated attacker can initiate repeated login attempts with incorrect passwords, leading to a temporary lockout of legitimate users. This results in users being unable to access their accounts until the lockout period expires or the device is reset. Such a vulnerability can severely disrupt operations, making systems susceptible to denial-of-service attacks.

References