Overview
The Common Vulnerabilities and Exposures system has identified an important vulnerability, CVE-2025-3755, that affects Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules. These modules used across various industry sectors are exposed to an unauthenticated remote attack that can lead to system compromise or data leakage. The vulnerability primarily involves improper validation of specified index, position, or offset in input, rendering the system susceptible to Denial-of-Service (DoS) attacks or inadvertent shutdown of the CPU module.
Vulnerability Summary
CVE ID: CVE-2025-3755
Severity: Critical (CVSS 9.1)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthenticated access, potential system compromise or data leakage, and Denial-of-Service (DoS) condition.
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules | All versions prior to the patch
How the Exploit Works
The exploit works by sending specifically crafted packets to the target system. Due to a flaw in the input validation process, an attacker can manipulate the index, position, or offset in input, causing the system to behave unexpectedly. This could lead to unauthorized access to system information, a DoS condition in MELSOFT connection, or an abrupt stop in the CPU module operation causing a DoS condition on the CPU module itself.
Conceptual Example Code
While the specific details of the exploit are highly technical and beyond the scope of this blog post, the conceptual example below illustrates how a malicious HTTP request could be crafted:
POST /target_endpoint HTTP/1.1
Host: vulnerable.iq-f_module.com
Content-Type: application/json
{ "manipulated_index": "..." }In this example, the `manipulated_index` would contain the malicious payload, crafted in such a way as to exploit the improper input validation vulnerability.
Mitigation
Mitsubishi Electric Corporation has released a patch to address this vulnerability. All users are strongly encouraged to apply the patch as soon as possible. If the patch cannot be applied immediately, users are advised to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure. These steps will help to limit the potential damage caused by an unauthenticated attacker exploiting this vulnerability.