CVE-2023-4625

Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module

Medium5.3EPSS 1.3%

Published: 6 Nov 2023
Updated: 27 Feb 2025
Reserved: 30 Aug 2023
Assigned by: Mitsubishi

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.

Timeline

2023
30 Aug 2023
30 Aug 2023
ID reserved
By Mitsubishi
6 Nov 20232 months later
6 Nov 2023· 2 months later
Published
2025
27 Feb 202516 months later
27 Feb 2025· 16 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-4625, by who scored it
Scored by	CVSS	Score	Vector
MitsubishiCNA (assigner)	3.1	Medium5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Modified	3.1	Medium5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS (exploitation in 30 days): 1.3% · top 28% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

CWE-307 Improper Restriction of Excessive Authentication Attempts (opens in a new tab)All about CWE-307 and its CVEs

Affected products

Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/ES
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/DS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ESS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ESS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/ESS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/D
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-64MT/D
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-96MT/D
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-64MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-96MT/DSS
- affected all versions (for serial number 17X**** and later)
- affected 1.060 or later (for serial number 179**** and prior)
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/DS-TS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/DSS-TS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MR/DS-TS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MT/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MT/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MT/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MR/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MR/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MR/DS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MT/DSS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MT/DSS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MT/DSS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MT/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MT/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MT/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-24MR/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-40MR/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UJ-60MR/ES-A
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-30MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-40MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-60MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-80MT/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-30MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-40MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-60MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-80MR/ES
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-30MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-40MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-60MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5S-80MT/ESS
- affected all versions
Mitsubishi Electric Corporation · MELSEC iQ-R Series R00CPU
- affected versions 05 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R01CPU
- affected versions 05 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R02CPU
- affected versions 05 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R04CPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R08CPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R16CPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R32CPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R120CPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R04ENCPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R08ENCPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R16ENCPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R32ENCPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R120ENCPU
- affected versions 35 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R08PCPU
- affected versions 37 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R16PCPU
- affected versions 37 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R32PCPU
- affected versions 37 or later
Mitsubishi Electric Corporation · MELSEC iQ-R Series R120PCPU
- affected versions 37 or later

References (3)

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf (opens in a new tab)vendor-advisoryx_transferred
https://jvn.jp/vu/JVNVU94620134 (opens in a new tab)government-resourcex_transferred
https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02 (opens in a new tab)government-resourcex_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-4625](https://trackcve.app/badge/CVE-2023-4625.svg)](https://trackcve.app/cve/CVE-2023-4625)

Record last updated 27 Feb 2025, 20:34 UTC.