Medium severity · published Nov 6, 2023
CVE-2023-4625
Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
MELSEC iQ-F Series FX5S-30MR/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-30MT/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-30MT/ESS · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-40MR/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-40MT/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-60MR/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-60MT/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-80MR/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5S-80MT/ES · Mitsubishi Electric Corporation
all versions · source: vendor
MI
MELSEC iQ-F Series FX5U-32MR/DS · Mitsubishi Electric Corporation
all versions (for serial number 17X**** and later); 1.060 or later (for serial number 179**** and prior) · source: vendor
MI
MELSEC iQ-F Series FX5U-32MR/ES · Mitsubishi Electric Corporation
all versions (for serial number 17X**** and later); 1.060 or later (for serial number 179**** and prior) · source: vendor
MI
MELSEC iQ-F Series FX5U-32MT/DS · Mitsubishi Electric Corporation
all versions (for serial number 17X**** and later); 1.060 or later (for serial number 179**** and prior) · source: vendor
Affected product
MI
MELSEC iQ-F Series FX5S-30MR/ES
Mitsubishi Electric Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4625
Third Party Advisory
https://jvn.jp/vu/JVNVU94620134
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf
More from MELSEC iQ-F Series FX5S-30MR/ES
9.1
CVE-2025-3755
Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module
7.5
CVE-2025-7731
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
7.3
CVE-2025-7405
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
5.3
CVE-2025-10259
Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module
5.3
CVE-2025-5514
Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module