CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-233-01: Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (Update A) ↗ source

August 21, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-233-01

Summary

Successful exploitation of this vulnerability could result in a remote attacker being able to delay the processing of the Web server function and prevent legitimate users from utilizing the Web server function by sending a specially crafted HTTP request. CVE-2025-5514: A Denial-of-Service (DoS) vulnerability due to Improper Handling of Length Parameter Inconsistency exists in the Web server function of the MELSEC iQ-F Series CPU module.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-233-01
Status
Final · version 2
Initial release
2025-08-21
Last revised
2025-09-09 (2 revisions)
Vendor
Mitsubishi Electric Corporation
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Japan

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Thai Do, Minh Pham, Quan Le, Loc Nguyen (OPSWAT Unit515); Mitsubishi Electric Corporation

Affected products (75)
  • MELSEC iQ-F Series CPU module FX5U-32MT/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/ESS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MR/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MR/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/ESS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MR/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MR/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/ESS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MR/ES — >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MR/DS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-32MT/D — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-32MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-64MT/D — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-64MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-96MT/D — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-96MT/DSS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-32MT/DS-TS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-32MT/DSS-TS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UC-32MR/DS-TS — >=1.060
  • MELSEC iQ-F Series CPU module FX5UJ-24MT/ES — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-24MT/DS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-24MT/ESS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-24MT/DSS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-24MR/ES — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-24MR/DS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MT/ES — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MT/DS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MT/ESS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MT/DSS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MR/ES — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-40MR/DS — all versions
  • MELSEC iQ-F Series CPU module FX5UJ-60MT/ES — all versions
  • … and 35 more in the source document
Revision history (2)
  • 2025-09-09 — v2: Update A - Addition to the list of affected products
  • 2025-08-21 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2025-5514 CWE-130 Improper Handling of Length Parameter Inconsistency 5.3 Medium A Denial-of-Service (DoS) vulnerability due to Improper Handling of Length Parameter Inconsistency exists in the Web server function of the MELSEC iQ-F Series CPU module.

Mitigation: Mitsubishi Electric Corporation advises that there are no plans to release a fixed version. Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting this vulnerability:

Mitigation: Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls.

Affected, fixed & timeline

Affected:

  • MELSEC iQ-F Series CPU module FX5U-32MT/ES >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/DS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/ESS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MT/DSS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MR/ES >=1.060
  • MELSEC iQ-F Series CPU module FX5U-32MR/DS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/ES >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/DS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/ESS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MT/DSS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MR/ES >=1.060
  • MELSEC iQ-F Series CPU module FX5U-64MR/DS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/ES >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/DS >=1.060
  • MELSEC iQ-F Series CPU module FX5U-80MT/ESS >=1.060
  • … and 60 more

Mitigation: Use IP filter function to block access from untrusted hosts. For details on the IP filter function, please refer to the manual for each product: "13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication)

Mitigation: Restrict physical access to the affected products and the LAN that is connected by them.

Mitigation: Mitsubishi Electric Corporation recommends users contact their local Mitsubishi Electric representative with questions.

Mitigation: For more information, see Mitsubishi Electric's security advisory.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2025-5514 5.3 Medium Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU mo…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.