Introduction
Credential theft and unauthorized device manipulation in manufacturing environments can have direct operational and safety consequences. CVE-2025-7731 is a critical flaw in Mitsubishi Electric's MELSEC iQ-F Series CPU modules that lets attackers intercept cleartext credentials and take control of programmable logic controllers (PLCs) used in factories worldwide.
About Mitsubishi Electric and MELSEC: Mitsubishi Electric is a leading global supplier of industrial automation and control systems, and its MELSEC product line is deployed across a wide range of manufacturing and critical infrastructure environments. The MELSEC iQ-F Series is a modern PLC family for controlling industrial processes, so this vulnerability is relevant to a large number of organizations in the manufacturing sector.
Technical Information
The cause of CVE-2025-7731 is cleartext transmission of sensitive authentication information in the Seamless Message Protocol (SLMP), as implemented by MELSEC iQ-F Series CPU modules. When an external device (such as an engineering workstation or HMI) talks to a vulnerable PLC over Ethernet, SLMP sends credential information in cleartext, with no encryption or obfuscation.
An attacker on the same network segment as the PLC can intercept SLMP messages with standard packet capture tools such as Wireshark. Because the credentials are unprotected, the attacker can pull valid authentication data straight out of the network traffic. With those credentials, the attacker can:
- Read or write device values on the PLC
- Stop the execution of control programs
The attack needs no authentication, privilege escalation, or user interaction. Attack complexity is low, and exploitation requires only network access to the SLMP communication channel. The vulnerability is present in all firmware versions of the affected product lines, and Mitsubishi Electric has confirmed that it will not release a firmware fix.
Affected Systems and Versions
The following MELSEC iQ-F Series CPU module families and models are affected. All versions of these models are vulnerable:
FX5U Series:
- FX5U-32MT/ES, FX5U-32MT/DS, FX5U-32MT/ESS, FX5U-32MT/DSS
- FX5U-32MR/ES, FX5U-32MR/DS
- FX5U-64MT/ES, FX5U-64MT/DS, FX5U-64MT/ESS, FX5U-64MT/DSS
- FX5U-64MR/ES, FX5U-64MR/DS
- FX5U-80MT/ES, FX5U-80MT/DS, FX5U-80MT/ESS, FX5U-80MT/DSS
- FX5U-80MR/ES, FX5U-80MR/DS
FX5UC Series:
- FX5UC-32MT/D, FX5UC-32MT/DSS, FX5UC-64MT/D, FX5UC-64MT/DSS
- FX5UC-96MT/D, FX5UC-96MT/DSS
- FX5UC-32MT/DS-TS, FX5UC-32MT/DSS-TS, FX5UC-32MR/DS-TS
FX5UJ Series:
- FX5UJ-24MT/ES, FX5UJ-24MT/DS, FX5UJ-24MT/ESS, FX5UJ-24MT/DSS
- FX5UJ-24MR/ES, FX5UJ-24MR/DS
- FX5UJ-40MT/ES, FX5UJ-40MT/DS, FX5UJ-40MT/ESS, FX5UJ-40MT/DSS
- FX5UJ-40MR/ES, FX5UJ-40MR/DS
- FX5UJ-60MT/ES, FX5UJ-60MT/DS, FX5UJ-60MT/ESS, FX5UJ-60MT/DSS
- FX5UJ-60MR/ES, FX5UJ-60MR/DS
- FX5UJ-24MT/ES-A, FX5UJ-24MR/ES-A, FX5UJ-40MT/ES-A, FX5UJ-40MR/ES-A, FX5UJ-60MT/ES-A, FX5UJ-60MR/ES-A
FX5S Series:
- FX5S-30MT/ES, FX5S-30MT/DS, FX5S-30MT/ESS, FX5S-30MT/DSS
- FX5S-30MR/ES, FX5S-30MR/DS
- FX5S-40MT/ES, FX5S-40MT/DS, FX5S-40MT/ESS, FX5S-40MT/DSS
- FX5S-40MR/ES, FX5S-40MR/DS
- FX5S-60MT/ES, FX5S-60MT/DS, FX5S-60MT/ESS, FX5S-60MT/DSS
- FX5S-60MR/ES, FX5S-60MR/DS
- FX5S-80MT/ES, FX5S-80MT/DS, FX5S-80MT/ESS, FX5S-80MT/DSS
- FX5S-80MR/ES, FX5S-80MR/DS
Some FX5S models are region-specific but remain vulnerable wherever they are deployed. All versions are affected, and no firmware release is unaffected.
Vendor Security History
Mitsubishi Electric has previously disclosed vulnerabilities in the MELSEC product line, including authentication bypass and denial of service issues. The company runs a Product Security Incident Response Team (PSIRT) and is a CVE Numbering Authority, which points to a mature vulnerability disclosure process. For CVE-2025-7731, the vendor has stated that it will not provide a firmware fix, so customers must handle mitigation at the network level. Previous advisories for MELSEC products show that architectural security issues are a recurring problem.
