Introduction
Mitsubishi Electric MELSEC iQ-F Series controllers have no authentication on Modbus TCP. Production lines, water treatment plants, and food manufacturing facilities that use them are open to remote manipulation. Without credentials, an attacker can read or change device values and stop industrial programs, which directly affects operational continuity and safety.
About Mitsubishi Electric and MELSEC iQ-F: Mitsubishi Electric is a global leader in industrial automation, and its MELSEC product line runs in thousands of manufacturing, energy, and infrastructure sites worldwide. The iQ-F Series is one of its core programmable logic controller (PLC) families. It is known for its flexibility and is built into critical operations across many sectors.
Technical information
CVE-2025-7405 comes from the Modbus TCP implementation on MELSEC iQ-F Series CPU modules, which has no authentication. Modbus TCP is a widely used industrial protocol, and on these devices it requires no authentication or authorization for critical functions. Any remote system that can reach the controller's Modbus TCP ports (typically 502 or 503) can:
- Read device registers (disclosing process values, configuration, and operational data)
- Write to device registers (altering process parameters, manipulating logic, or causing unsafe states)
- Stop control programs (causing downtime or process interruption)
The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The device does not check the identity or permissions of the remote party, so any Modbus TCP client can issue commands. No code snippets or specific PoC details are publicly available. An attacker needs only network access and knowledge of the Modbus protocol.
Affected systems and versions
The following MELSEC iQ-F Series CPU modules are affected:
-
FX5U Series:
- FX5U-32MT/ES, FX5U-32MT/DS, FX5U-32MR/ES, FX5U-32MR/DS
- FX5U-64MT/ES, FX5U-64MT/DS, FX5U-64MR/ES, FX5U-64MR/DS
- FX5U-80MT/ES, FX5U-80MT/DS, FX5U-80MR/ES, FX5U-80MR/DS
- Affected firmware: Version 1.060 and later
-
FX5UC Series:
- FX5UC-32MT/DSS, FX5UC-32MT/DS, FX5UC-64MT/DSS, FX5UC-64MT/DS
- FX5UC-96MT/DSS, FX5UC-96MT/DS, FX5UC-32MT/DSS-TS, FX5UC-32MT/DS-TS
- Affected firmware: Version 1.060 and later
-
FX5UJ Series:
- FX5UJ-24MT/ES, FX5UJ-24MR/ES, FX5UJ-40MT/ES, FX5UJ-40MR/ES
- FX5UJ-60MT/ES, FX5UJ-60MR/ES, FX5UJ-60MT/ESS, FX5UJ-60MR/ESS
- FX5UJ-24MT/ES-A, FX5UJ-40MT/ES-A, FX5UJ-60MT/ES-A
- All firmware versions
-
FX5S Series:
- FX5S-30MT/ES, FX5S-30MR/ES, FX5S-40MT/ES, FX5S-40MR/ES
- FX5S-60MT/ES, FX5S-60MR/ES, FX5S-80MT/ES, FX5S-80MR/ES
- All firmware versions
No patch is planned for most affected models. If Modbus TCP is enabled and reachable, the device is vulnerable regardless of configuration.
Vendor security history
Mitsubishi Electric's security record on the MELSEC product line includes:
- Earlier authentication bypass and protocol parsing vulnerabilities (see CISA and vendor advisories)
- A pattern of relying on network-level mitigations rather than firmware patches for OT vulnerabilities
- A formal PSIRT, established in 2019, and CVE Numbering Authority status since 2020
- Patch response that varies by product and vulnerability. For CVE-2025-7405, no firmware fix is planned for most models.
