High severity · published Sep 1, 2025
CVE-2025-7731
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product and stop the operations of programs by using the obtained credential information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
MELSEC iQ-F Series FX5S-30MR/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-30MT/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-30MT/ESS · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-40MR/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-40MT/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-40MT/ESS · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-60MR/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-60MT/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5S-60MT/ESS · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5U-32MR/DS · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5U-32MR/ES · Mitsubishi Electric Corporation
All versions · source: vendor
MI
MELSEC iQ-F Series FX5U-32MT/DS · Mitsubishi Electric Corporation
All versions · source: vendor
Affected product
MI
MELSEC iQ-F Series FX5S-30MR/ES
Mitsubishi Electric Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7731
jvn.jp
https://jvn.jp/vu/JVNVU90041458/
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-02
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-012_en.pdf
More from MELSEC iQ-F Series FX5S-30MR/ES
9.1
CVE-2025-3755
Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module
7.3
CVE-2025-7405
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
5.3
CVE-2025-10259
Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module
5.3
CVE-2025-5514
Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module
5.3
CVE-2025-5241
Denial-of-Service Vulnerability in MELSEC iQ-F Series