CVE-2025-7405: MELSEC iQ-F Auth Bypass Vulnerability

CVE-2025-7405 Overview

CVE-2025-7405 is a Missing Authentication for Critical Function vulnerability (CWE-306) affecting Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules. The vulnerability exists because MODBUS/TCP in the affected products does not have authentication features, allowing a remote unauthenticated attacker to read or write device values and stop the operation of programs running on the industrial controller.

This vulnerability is particularly concerning in industrial control system (ICS) environments where these programmable logic controllers (PLCs) are deployed to manage critical manufacturing and infrastructure processes. The lack of authentication on the MODBUS/TCP protocol means that any network-accessible attacker can directly manipulate the controller without credentials.

Critical Impact

Remote unauthenticated attackers can read/write device values and stop program operations on MELSEC iQ-F Series CPU modules, potentially causing industrial process disruption or safety incidents.

Affected Products

• Mitsubishi Electric MELSEC iQ-F Series CPU modules with MODBUS/TCP enabled

Discovery Timeline

• September 1, 2025 - CVE-2025-7405 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2025-7405

Vulnerability Analysis

This vulnerability represents a fundamental design flaw in the MODBUS/TCP implementation on Mitsubishi Electric MELSEC iQ-F Series CPU modules. The MODBUS protocol, originally designed in 1979 for serial communications, was later adapted for TCP/IP networks but historically lacked built-in security mechanisms. In this case, the affected CPU modules expose MODBUS/TCP services without requiring any form of authentication, leaving critical industrial control functions completely unprotected.

The vulnerability allows attackers to perform three primary malicious actions: reading device values (potentially exposing sensitive process data), writing device values (enabling manipulation of industrial processes), and stopping program execution (causing denial of service to automated operations). For organizations using these controllers in manufacturing, utilities, or other critical infrastructure, exploitation could result in production shutdowns, equipment damage, or safety hazards.

Root Cause

The root cause is the absence of authentication mechanisms in the MODBUS/TCP implementation on MELSEC iQ-F Series CPU modules. MODBUS/TCP, by its original design, does not include native authentication or encryption capabilities. The affected products expose this protocol without implementing additional security layers to verify the identity of connecting clients, allowing any network-reachable entity to issue MODBUS commands to the controller.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the MODBUS/TCP service (typically on TCP port 502). An attacker can exploit this vulnerability by connecting to the exposed MODBUS/TCP service and sending valid MODBUS function codes to read holding registers, write coils or registers, or issue commands that halt program execution. No special tools beyond standard MODBUS client utilities are required, and no authentication credentials are needed.

The attack does not require user interaction and can be executed with low complexity once network access is established. Organizations that expose these controllers to untrusted networks or have insufficient network segmentation are at elevated risk.

Detection Methods for CVE-2025-7405

Indicators of Compromise

• Unexpected MODBUS/TCP connections from unauthorized IP addresses to port 502 on MELSEC iQ-F controllers
• Anomalous read or write operations to device registers outside of normal operational patterns
• Unexpected program stops or state changes on MELSEC iQ-F CPU modules
• Network traffic analysis showing MODBUS commands from non-standard sources

Detection Strategies

• Deploy network intrusion detection systems (IDS) with MODBUS/TCP protocol parsing capabilities to monitor for unauthorized commands
• Implement network segmentation monitoring to detect traffic crossing security zone boundaries toward ICS networks
• Configure logging on firewalls and network devices to capture all connections to MODBUS/TCP services on affected controllers
• Use industrial protocol anomaly detection tools to identify deviations from baseline MODBUS traffic patterns

Monitoring Recommendations

• Continuously monitor network traffic to and from MELSEC iQ-F Series CPU modules for unauthorized access attempts
• Establish baseline operational profiles for MODBUS communications and alert on deviations
• Implement asset inventory and regularly verify that only authorized systems communicate with affected controllers
• Review firewall logs and access control lists protecting the industrial control network on a regular basis

How to Mitigate CVE-2025-7405

Immediate Actions Required

• Isolate affected MELSEC iQ-F Series CPU modules from untrusted networks using firewalls and network segmentation
• Restrict MODBUS/TCP access (TCP port 502) to only authorized engineering workstations and SCADA systems
• Implement network access control lists (ACLs) to limit which IP addresses can communicate with the affected controllers
• Review and update firewall rules to ensure no direct internet exposure of MODBUS/TCP services

Patch Information

Mitsubishi Electric has published a security advisory addressing this vulnerability. Organizations should consult the Mitsubishi Electric Vulnerability PDF for specific firmware update information and remediation guidance. Additional details are available in the CISA ICS Advisory ICSA-25-240-01 and the JVN Vulnerability Report.

Workarounds

• Implement strict network segmentation to isolate MELSEC iQ-F controllers in a protected ICS/SCADA network zone
• Deploy a firewall or industrial demilitarized zone (DMZ) between corporate networks and the control system network
• Use VPN or secure remote access solutions if remote connectivity to controllers is required
• Consider implementing a MODBUS/TCP security gateway or protocol-aware firewall that can filter and authenticate MODBUS commands

# Example firewall rule to restrict MODBUS/TCP access (iptables)
# Allow only authorized SCADA server (192.168.10.50) to access controller on port 502
iptables -A INPUT -p tcp --dport 502 -s 192.168.10.50 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -j DROP