MELSEC iQ-F Modbus/TCP CVE-2025-7405: Mitigation Guide for Windows & OT

Mitsubishi Electric’s MELSEC iQ‑F family of CPU modules has been formally flagged with a network‑accessible vulnerability that allows unauthenticated remote actors to read and write device values — and in some deployments to halt program execution — because the affected product’s Modbus/TCP handling lacks authentication for critical functions. CISA published an advisory on August 28, 2025 that consolidates vendor information and assigns a CVSS v4 base score of 6.9 for the issue tracked as CVE‑2025‑7405, and Mitsubishi Electric’s vulnerability materials acknowledge the broad list of affected SKUs and recommend network‑level mitigations rather than an immediate firmware replacement for many models. (cisa.gov) (mitsubishielectric.com)

Background / Overview​

MELSEC iQ‑F CPU modules are compact programmable logic controllers (PLCs) widely deployed across manufacturing and industrial automation environments. Their Ethernet and Modbus/TCP features are designed for ease of integration with supervisory systems, HMIs, and third‑party equipment. Historically, this product family has been the subject of several advisories covering a variety of issues — from OpenSSL‑related DoS bugs to parsing and indexing defects — so the presence of a remotely reachable weakness in a communications protocol is not unprecedented for this line. (mitsubishielectric.com)
The newly announced issue, recorded by CISA as ICSA‑25‑240‑01 and tied to CVE‑2025‑7405, is categorized under Missing Authentication for Critical Function (CWE‑306). The upshot: because Modbus/TCP carries no built‑in authentication, an unauthenticated remote actor who can reach the PLC over the network may be able to perform read/write actions on device registers and, in many operational contexts, trigger program stoppage or manipulation of control values. CISA’s advisory presents the vulnerability, lists dozens of affected models, and reproduces Mitsubishi Electric’s guidance that network isolation, IP filtering, and physical control remain the primary mitigations. (cisa.gov)

---

What the advisory says — concise executive summary​

• The vulnerability affects a wide range of MELSEC iQ‑F CPU module SKUs (FX5U, FX5UC, FX5UJ, FX5S families), with specific firmware thresholds noted for many FX5U/FX5UC models and “All versions” marked for multiple FX5UJ/FX5S SKUs. (cisa.gov)
• The problem is classified as Missing Authentication for Critical Function (CWE‑306), because Modbus/TCP sessions the devices accept do not require authentication and therefore can be used to alter device state. (cisa.gov)
• CVE‑2025‑7405 is the identifier attached in the advisory; CISA lists both CVSS v3.1 (7.3) and CVSS v4 (6.9) base scores. (cisa.gov)
• Mitsubishi Electric’s guidance for many affected models states no fixed firmware version will be released for the issue; the vendor recommends network isolation, IP‑filter configuration, VPNs and restricted physical access as mitigations. (cisa.gov)

These headline points represent the most important operational facts for asset owners and incident responders.

---

Technical analysis: root cause, attack surface, and practical exploitability​

Missing authentication on Modbus/TCP: why it matters​

Modbus/TCP is a widely used industrial protocol that originally assumed a trusted network context; it offers no standard message‑level authentication. When devices expose Modbus/TCP endpoints directly to a business network or the internet (or allow transit through poorly segmented remote‑maintenance links), any actor who can reach the port can query registers or issue writes. In the context of PLCs, register writes can change setpoints, flip outputs, or alter logic variables used by safety or control routines — making confidentiality, integrity and availability risks all realistic consequences. The CISA advisory explicitly calls out information disclosure, information tampering and denial‑of‑service impacts stemming from missing authentication on Modbus/TCP in the MELSEC iQ‑F series. (cisa.gov)

Attack prerequisites and complexity​

• Attack vector: Network (an attacker must be able to reach the PLC’s IP and Modbus/TCP port).
• Privileges required: None (unauthenticated).
• Attack complexity: Low — crafting Modbus/TCP read/write requests is trivial for anyone with basic scripting ability or off‑the‑shelf tools.
• Likely detection difficulty: Moderate; noisy write attempts may trigger basic alarms, but careful, low‑and‑slow manipulation can be subtle and may blend into normal operational traffic unless ICS‑aware detection is deployed.

The combination of low complexity and no authentication required places this vulnerability high on the practical risk scale whenever remote reachability exists. CISA and vendor guidance therefore emphasize access control over reactive patching for affected models. (cisa.gov)

What can an attacker do in real environments?​

• Read device values that may reveal process setpoints or production parameters.
• Write registers to alter sensor thresholds, trip outputs, or change internal flags that control program flow.
• Force program stoppage or place the PLC in a state that requires manual intervention or restart to recover, causing availability outages.
• Use read/writes as a staging action for further tampering (e.g., instructing actuators to move to dangerous positions or masking telemetry).

These scenarios are realistic in industrial settings where PLCs directly control or supervise mechanical processes and where control‑plane recovery procedures require human intervention. (cisa.gov)

---

Affected products: the scope and what to inventory now​

The advisory includes an exhaustive SKU listing: dozens of FX5U and FX5UC variants with firmware thresholds of 1.060 and later for certain entries, and many FX5UJ and FX5S models listed as All versions. Operators must not assume “older vs newer” is protective; Mitsubishi’s advisory marks specific firmware ranges for some models but leaves others as fully affected. The practical implication is simple: treat every iQ‑F CPU module in your estate as potentially impacted until you confirm otherwise by checking the device model, firmware version and the vendor security bulletin or product manual. (cisa.gov)
Operational teams should immediately produce an inventory that includes:

• Model number and hardware SKUs (e.g., FX5U‑64MT/ESS).
• Firmware or OS version (the unit’s communication/firmware build).
• IP addresses, exposed ports, and network segment.
• Whether Modbus/TCP or other management web interfaces are reachable from business networks or the internet.

This inventory is the first and most important mitigation step: the attack surface is defined by exposure, not by vendor model names alone.

---

Mitigation and containment: prioritized actions for Windows‑centric operations teams​

When vendor firmware fixes are not available (or vendor has stated no fix will be supplied for some models), the pragmatic approach is defense‑in‑depth. The following steps are ordered by immediacy and impact:

• Immediate containment
• Block public access: Remove any firewall rules that expose the PLC’s management or Modbus/TCP port to the internet. If remote maintenance is required, disable direct access immediately. (cisa.gov)
• Isolate into a management VLAN: Place affected PLCs behind segmentation VLANs that allow only known management hosts (SCADA servers, jump hosts) to communicate. Configure ACLs to allow only necessary flows. (cisa.gov)
• Enable device IP filtering: Many MELSEC iQ‑F devices provide an IP filter function; use it to restrict accepted source IPs to specific administrator or maintenance hosts. Vendor manuals describe the IP filter configuration (see the FX5 user manual “13.1 IP Filter Function”). (cisa.gov)
• Short‑term defensive hardening
• Require remote maintenance via a hardened jump host or industrial VPN that is single‑purpose, monitored and MFA‑protected. Ensure VPN endpoints are current and that client endpoints are managed Windows workstations with EDR and patch hygiene. (cisa.gov)
• Deploy a Web Application Firewall (WAF) or application‑aware IDS/IPS in front of any unavoidable web management interface; tune rules to detect abnormal Modbus or HTTP parameter manipulations.
• Implement logging and SIEM rules on Windows servers that manage PLCs: alert on repeated Modbus/TCP connections from unknown hosts, abnormal register write patterns, and unexpected PLC resets.
• Detection and monitoring
• Create hunt queries for the Windows SIEM that identify Modbus/TCP sessions originating from non‑approved hosts, and forward those events to OT/ICS teams.
• On the OT side, monitor PLC program restarts, abnormal state transitions and HMI operator overrides. Correlate those events with Windows AD and management workstation logs to detect coordinated activity.
• Medium‑term recovery planning
• If a PLC must remain in the network but cannot be made unreachable, limit its operations to safe maintenance windows, and add physical redundancy or manual overrides for critical control loops.
• For systems where availability is critical, plan staged hardware replacement for units that have no vendor fix and represent unacceptable residual risk.
• Communication procedures
• Notify maintenance vendors and integrators. Ensure that remote maintenance access is paused or moved to the managed jump host.
• If a suspected compromise is discovered, follow internal incident response playbooks and report to national CSIRT/CISA channels as appropriate. CISA requests organizations report suspicious activity to support cross‑incident correlation. (cisa.gov)

---

How Windows administrators should coordinate with OT teams​

Windows administrators and SOC teams are the natural first line for network policy changes, VPN controls and SIEM detection. Coordination points:

• Network segmentation: Windows teams should work with OT to ensure PLC management networks are firewalled from business subnets and routed only through monitored jump hosts.
• VPN and remote access: Ensure any Windows hosts used to access PLCs are hardened (full disk encryption, local admin restrictions, endpoint detection and response, and MFA on VPN).
• Logging and telemetry: Forward Windows event logs, VPN logs, and jump host session records to the SOC for correlation with OT telemetry (PLC state changes, HMI events).
• Patch and maintenance scheduling: When Mitsubishi releases updates or clarifications, coordinate controlled firmware upgrades during maintenance windows; always take full backups and test updates in lab environments before production rollout. Mitsubishi’s support channels and product manuals should be consulted for firmware update instructions. (mitsubishielectric.com)

---

Detection: what to look for in the wild​

Indicators of attempted exploitation can be noisy or subtle; prioritize these signals:

• Unexpected Modbus/TCP sessions from external IPs or from Windows user workstations that do not normally manage PLCs.
• Repeated register‑write attempts to a range of addresses or writes to configuration registers outside normal maintenance windows.
• Unplanned PLC program stops or module resets coincident with anomalous network traffic.
• Jump host session activity outside scheduled maintenance windows, particularly when paired with Modbus/TCP flows.

Tune SIEM rules to escalate when any of these indicators coincide, and preserve packet captures and PLC logs for forensic analysis.

---

Why vendor posture matters — strengths and limits of the response​

Mitsubishi Electric and CISA are transparent in enumerating affected SKUs and describing the technical root cause. That disclosure is valuable because it lets defenders triage and apply access controls immediately across a broad installed base. Mitsubishi’s ongoing vulnerability index shows a pattern of proactive advisory publication and detailed countermeasure guidance for many vulnerabilities in the MELSEC family, demonstrating responsible vendor engagement. (mitsubishielectric.com)
However, there are operational drawbacks in this instance:

• For numerous models included in the advisory, Mitsubishi has stated there are no plans to release a fixed firmware version, which means defenders are reliant on network‑level mitigations for an indeterminate period. That leaves long‑tail risk for facilities that cannot feasibly replace or isolate hardware quickly. (cisa.gov)
• Modbus/TCP’s lack of native authentication is an architectural limitation; retrofitting message‑level authentication into a widely deployed PLC product line is nontrivial and can break interoperability. Vendors must weigh compatibility, certification and field‑support realities when deciding whether to deliver firmware changes — and sometimes the practical path is to furnish guidance rather than a binary patch. This is understandable yet operationally unsatisfying for defenders in high‑assurance environments.

Because the vendor’s approach leaves mitigation responsibility with customers, asset owners should prioritize compensating controls and consider hardware replacement or vendor migration when sustained exposure cannot be eliminated.

---

Practical, prioritized checklist (ready‑to‑use)​

• Inventory: Identify all MELSEC iQ‑F devices by model, firmware, IP and network segment. (cisa.gov)
• Isolate: Immediately block Modbus/TCP and management ports at the edge; move any legitimate remote access to an authenticated jump host/VPN. (cisa.gov)
• IP filtering: Enable the PLC’s IP filter function and lock accepted source IPs to trusted management hosts. (cisa.gov)
• Monitor: Add SIEM detections for Modbus/TCP flows, unexpected writes, and PLC restarts. Log jump host sessions and correlate with OT telemetry.
• Harden Windows endpoints: Ensure jump hosts and maintenance Windows systems have EDR, MFA, least privilege and current patches.
• Test and plan: If a patch becomes available, test in lab before production; otherwise plan for hardware replacement or additional segmentation where necessary.

---

Unverifiable or rapidly changing details — cautionary notes​

• Multiple related MELSEC advisories and CVE identifiers have been published across 2023–2025 (examples include CVE‑2024‑8403, CVE‑2025‑3755, CVE‑2025‑5241 and others). Public CVE registries (NVD, CVE.org) sometimes lag in mirroring vendor reports; treat the vendor advisory and CISA notice as the authoritative operational guidance while corroborating CVE metadata as NVD/CVE mirrors become populated. Where a CVE number or CVSS score is referenced in third‑party summaries, confirm the identifier and score against the primary vendor/CISA advisory when making remediation decisions. (cisa.gov)
• The vendor’s statement that “no fixed firmware will be released” may apply to specific subsets of SKUs; continue to check Mitsubishi Electric’s vulnerability index and product PSIRT pages for changes — vendors occasionally produce targeted firmware or hardware guidance after initial publication. (mitsubishielectric.com)

---

Final assessment: risk vs. operational reality​

This vulnerability sits at a painful intersection for industrial operators: the technical root cause (protocols lacking authentication) is historical and architectural, exploitation complexity is low, and the impact ranges across confidentiality, integrity and availability for systems that can directly affect physical processes. For Windows‑centered IT teams supporting OT assets, the practical defensive posture is clear:

• Treat network exposure as the single greatest risk driver and reduce it aggressively.
• Assume long mitigation windows unless a clear vendor fix is announced and tested.
• Use Windows‑side controls (jump hosts, hardened VPN endpoints, SIEM detections, EDR) to raise the cost and visibility of any attempt to reach or manipulate PLCs. (cisa.gov)

The vendor’s repeated advisories for MELSEC families show engagement and a willingness to publish mitigations; nonetheless, the lack of universal firmware fixes for every affected SKU leaves defenders responsible for creating and maintaining resilient, layered access controls. Given the potential for high‑impact physical process disruption, that defensive work should be treated as urgent and prioritized in any operational‑risk program.

---

Conclusion​

CVE‑2025‑7405 and the associated CISA advisory for the MELSEC iQ‑F CPU modules crystallize a familiar ICS security dilemma: widely deployed devices using legacy or convenience‑oriented protocols become critical points of exposure when those protocols lack authentication. Mitsubishi Electric’s advisories and CISA’s guidance provide the operational facts necessary to triage risk; the pragmatic answer for most organizations is not a single patch but a program of isolation, strict access control, vigilant detection and, where acceptable risk cannot be achieved, planned hardware lifecycle replacement. Windows administrators, SOC teams and OT engineers must act in concert: inventory, isolate, monitor, and harden — and keep reconciling vendor advisories with on‑the‑ground risk as new information or fixes appear. (cisa.gov) (mitsubishielectric.com)

---

---

Source: CISA Mitsubishi Electric MELSEC iQ-F Series CPU Module | CISA