Loading story…
CISA warned that Mitsubishi Electric MELSOFT iQ AppPortal contains two vulnerabilities affecting versions 1.00A through 1.29F: CVE-2022-26377, an HTTP request smuggling flaw, and CVE-2022-31813, an insufficient verification of data authenticity issue that can bypass IP-based authentication. The vulnerabilities carry a maximum CVSS v3 score of 9.8 and could allow authentication bypass, information disclosure, denial of service, and circumvention of IP address-based access controls in a product used in the critical manufacturing sector worldwide.
Mitsubishi Electric reported the issues and advised customers to upgrade to MELSOFT iQ AppPortal version 1.32J or later. CISA also urged operators to reduce exposure by restricting network access with firewalls or VPNs, limiting access to trusted hosts and networks, minimizing user privileges, and disabling mod_proxy and mod_proxy_ajp where possible, alongside standard defensive measures such as antivirus deployment.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published an ICS advisory covering the Mitsubishi Electric MELSOFT iQ AppPortal vulnerabilities, highlighting a maximum CVSS v3 score of 9.8. The advisory noted the product's use in the critical manufacturing sector and worldwide deployment.
Mitsubishi Electric recommended upgrading affected installations to MELSOFT iQ AppPortal version 1.32J or later to remediate the vulnerabilities. The vendor also advised mitigations such as disabling mod_proxy and mod_proxy_ajp where possible and restricting network exposure.
Mitsubishi Electric identified and reported two vulnerabilities affecting MELSOFT iQ AppPortal versions 1.00A through 1.29F: CVE-2022-26377 and CVE-2022-31813. The flaws could enable impacts including authentication bypass, information disclosure, denial of service, and bypass of IP-based authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued multiple advisories covering vulnerabilities in Mitsubishi Electric industrial control system products, including **MELFA SD/SQ and F-series robot controllers**, **MELSEC iQ-F**, **iQ-R**, **Q**, **L series**, and **MELIPC** platforms. The most severe issues included remotely exploitable authentication weaknesses in factory automation devices and an authentication bypass in robot controllers caused by active debug code, tracked as `CVE-2022-33323`, which could permit unauthorized telnet access. Other flaws, including `CVE-2022-25155` through `CVE-2022-25160`, involved weak or improper authentication handling, cleartext storage of sensitive information, and capture-replay abuse that could let unauthenticated attackers log in, disclose data, tamper with product information, or impersonate legitimate users. A separate advisory also warned that multiple Intel third-party component vulnerabilities affected Mitsubishi Electric factory automation products, creating risks including privilege escalation, parameter disclosure, and denial of service, with a worst-case **CVSS v3 8.8**. Mitsubishi Electric released firmware updates or mitigation guidance and directed customers to vendor bulletins and Intel advisories where applicable. CISA urged operators to limit network exposure, isolate control systems from business networks, use firewalls or VPNs for remote access, restrict physical access where relevant, and follow standard ICS hardening practices. The advisories said no known public exploits were specifically targeting these vulnerabilities at the time of publication.
Jun 29, 2026
CISA and Mitsubishi Electric disclosed multiple denial-of-service vulnerabilities affecting **MELSEC iQ-R** industrial controllers and related modules used in the critical manufacturing sector. The issues include improper input validation in `CVE-2022-40265`, improper session management in `CVE-2021-20591`, and uncontrolled resource consumption flaws tracked as `CVE-2020-5666` and `CVE-2020-5527`. The vulnerabilities can be exploited remotely in various configurations to disrupt communications, block legitimate client connections, or force affected devices into an unresponsive state that may require a system reset or port recovery. Affected products span MELSEC iQ-R CPU modules, Ethernet interfaces, C Controller modules, and broader MELSEC controller families including **iQ-F, Q, L, and F series** in some cases. Mitsubishi Electric issued firmware updates and mitigations such as disabling unnecessary web server functions, upgrading to fixed firmware, restricting network access with firewalls and IP filtering, and limiting exposure to trusted LAN environments or VPN-protected remote access. CISA also urged operators to isolate control systems from business networks and reduce Internet exposure; at the time of the advisories, no known public exploits were reported as specifically targeting these flaws.
Jun 29, 2026
CISA issued an updated industrial control systems advisory for Mitsubishi Electric **MELSEC iQ-F, iQ-R, Q, and L series** products affected by a plaintext password storage flaw tracked as **`CVE-2023-0457`** and classified as **`CWE-256`**. The vulnerability allows an unauthenticated remote attacker to recover plaintext credentials from project files and potentially use them to authenticate to associated **FTP** or web servers. CISA assigned the issue a **CVSS v3 score of 7.5** and said the weakness affects multiple CPU and Ethernet modules across the listed MELSEC product families. Mitsubishi Electric and CISA advised operators to reduce exposure by encrypting project files and communications, restricting network access with firewalls or VPNs, preferring LAN-only deployments where feasible, limiting physical access, and enabling IP filtering on supported iQ-F and iQ-R devices. The updated notice builds on an earlier CISA advisory covering the MELSEC iQ-F series, while CISA said it is not aware of public exploits specifically targeting this vulnerability.
Jun 29, 2026