Loading story…
CISA issued an updated industrial control systems advisory for Mitsubishi Electric MELSEC iQ-F, iQ-R, Q, and L series products affected by a plaintext password storage flaw tracked as CVE-2023-0457 and classified as CWE-256. The vulnerability allows an unauthenticated remote attacker to recover plaintext credentials from project files and potentially use them to authenticate to associated FTP or web servers. CISA assigned the issue a CVSS v3 score of 7.5 and said the weakness affects multiple CPU and Ethernet modules across the listed MELSEC product families.
Mitsubishi Electric and CISA advised operators to reduce exposure by encrypting project files and communications, restricting network access with firewalls or VPNs, preferring LAN-only deployments where feasible, limiting physical access, and enabling IP filtering on supported iQ-F and iQ-R devices. The updated notice builds on an earlier CISA advisory covering the MELSEC iQ-F series, while CISA said it is not aware of public exploits specifically targeting this vulnerability.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published Update A for the Mitsubishi Electric advisory, stating that MELSEC iQ-F, iQ-R, Q, and L series products were affected by CVE-2023-0457. The update described the risk of unauthenticated attackers obtaining plaintext credentials from project files and included mitigation guidance; CISA said it was unaware of public exploitation targeting the flaw.
CISA published ICS advisory ICSA-20-345-01 covering a plaintext password storage flaw affecting Mitsubishi Electric MELSEC iQ-F Series products. The issue, later tracked as CVE-2023-0457, could expose credentials stored in project files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued multiple ICS advisories covering **Mitsubishi Electric MELSEC** controllers used in critical manufacturing, warning that several product lines are exposed to remotely exploitable flaws. The most severe issues affect **MELSEC-Q/L Series** factory automation controllers, where five vulnerabilities—`CVE-2024-0802`, `CVE-2024-0803`, `CVE-2024-1915`, `CVE-2024-1916`, and `CVE-2024-1917`—carry **CVSS 9.8** ratings and could let an attacker read arbitrary information or execute malicious code by sending crafted packets. Mitsubishi released remediated versions tied to newer serial-number ranges, and CISA said no public exploitation had been reported at publication. Separate advisories also warned that **MELSEC iQ-R Series Safety CPU and SIL2 Process CPU** modules contain flaws that can expose usernames through brute-force attempts (`CVE-2021-20594`), leak credentials via network sniffing (`CVE-2021-20597`), and lock out legitimate users after repeated failed logins (`CVE-2021-20598`). In addition, **MELSEC iQ-R, Q, and L Series** CPU modules are affected by an uncontrolled resource consumption bug, `CVE-2020-5652`, that can trigger a denial of service on the Ethernet port until the device is reset. Mitsubishi has provided firmware fixes for many affected systems, while CISA urged operators to isolate control networks, use firewalls or VPNs, block untrusted access, and apply compensating controls for legacy devices that cannot be updated.
Jun 29, 2026
CISA issued multiple advisories covering vulnerabilities in Mitsubishi Electric industrial control system products, including **MELFA SD/SQ and F-series robot controllers**, **MELSEC iQ-F**, **iQ-R**, **Q**, **L series**, and **MELIPC** platforms. The most severe issues included remotely exploitable authentication weaknesses in factory automation devices and an authentication bypass in robot controllers caused by active debug code, tracked as `CVE-2022-33323`, which could permit unauthorized telnet access. Other flaws, including `CVE-2022-25155` through `CVE-2022-25160`, involved weak or improper authentication handling, cleartext storage of sensitive information, and capture-replay abuse that could let unauthenticated attackers log in, disclose data, tamper with product information, or impersonate legitimate users. A separate advisory also warned that multiple Intel third-party component vulnerabilities affected Mitsubishi Electric factory automation products, creating risks including privilege escalation, parameter disclosure, and denial of service, with a worst-case **CVSS v3 8.8**. Mitsubishi Electric released firmware updates or mitigation guidance and directed customers to vendor bulletins and Intel advisories where applicable. CISA urged operators to limit network exposure, isolate control systems from business networks, use firewalls or VPNs for remote access, restrict physical access where relevant, and follow standard ICS hardening practices. The advisories said no known public exploits were specifically targeting these vulnerabilities at the time of publication.
Jun 29, 2026
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026