CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: Mitsubishi Electric
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-3755 | CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input | 9.1 Critical |
This vulnerability allows a remote attacker to read information in the product, cause a Denial-of-Service (DoS) condition in MELSOFT connection communication with Mitsubishi Electric FA products such as GX Works3 and GOT, or stop the operation of the CPU module (causing a DoS condition on the CPU module), by sending specially crafted packets. The product is needed to reset for recovery. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability: Mitigation: Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Affected, fixed & timelineAffected:
Mitigation: Use IP filter function to block access from untrusted hosts. Mitigation: Restrict physical access to the affected products and the LAN that is connected by them. Mitigation: For details on the IP filter function, please refer to the following manual for each product."13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication)Please download the manual from the following URL: https://www.mitsubishielectric.com/fa/download/index.html Mitigation: For more information, see Mitsubishi Electric advisory 2025-003. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-3755 | 9.1 Critical | Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules … |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.