Which versions of Mitsubishi Electric FA are affected by CVE-2025-3232?

Mitsubishi Electric FA products are affected by a high-severity authentication bypass that allows remote unauthenticated attackers to execute operating system commands through an exposed API route,…

How to fix or mitigate CVE-2025-3232?

Within 24 hours, inventory all Mitsubishi Electric FA products and identify any management/API interfaces reachable from untrusted networks; immediately remove direct internet exposure and enforce firewall or ACL rules allowing access only from trusted administrative hosts or VPN, and enable logging and alerting for unexpected API calls. Within 7 days, apply any vendor-released mitigations or workarounds from Mitsubishi Electric's advisory, deploy a compensating authentication layer such as a reverse proxy or API gateway where feasible, validate OT/IT segmentation, and conduct targeted scanning for affected devices using vendor guidance. Within 30 days, continue monitoring for a vendor patch, test and deploy it as soon as available, review incident response and recovery procedures for affected FA systems, and maintain an up-to-date asset inventory with firmware versions to support rapid remediation.

Mitsubishi Electric FA CVE-2025-3232

Q: What is the CVSS score of CVE-2025-3232?

CVE-2025-3232 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

HIGH

Missing Authentication for Critical Function (CWE-306)

2025-12-24 ics-cert@hq.dhs.gov

Authentication Bypass Mitsubishi Electric

8.7

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable auth bypass (PR:N/AV:N/AC:L) leading to arbitrary OS command execution, which yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 13:40 vuln.today

tag: Mitsubishi Electric added

Analysis Generated

Oct 07, 2026 - 13:39 vuln.today

CVE Published

Dec 24, 2025 - 20:15 cve.org

HIGH 8.7

DescriptionCVE.org

A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.

AnalysisAI

Remote unauthenticated attackers can bypass authentication on Mitsubishi Electric FA products through a specific API route to execute arbitrary OS commands, as reflected by CWE-306 (Missing Authentication for Critical Function). The independent CVSS 3.1 assessment rates this 8.7 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impact, though exploitation requires network reachability to the management/API interface. No public exploit code or confirmed active exploitation is identified in the available intelligence; the primary risk is unsegmented exposure of the device's API.

Technical ContextAI

The root cause is CWE-306, a missing authentication check on a critical API function. The affected technology is the management/API interface of Mitsubishi Electric FA (factory automation) products, likely a web-based API endpoint that processes OS commands without verifying caller identity. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) scores only integrity impact as high; the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability all high, consistent with arbitrary OS command execution. No CPE data or specific affected API route is provided; the CISA ICS advisory ICSA-25-105-09 and Mitsubishi Electric advisory should be consulted for exact product and firmware enumeration.

Affected ProductsAI

Affected products are Mitsubishi Electric FA (factory automation) devices as documented in CISA ICSA-25-105-09 and the Mitsubishi Electric advisory. The provided data does not enumerate specific model numbers, firmware versions, or CPE identifiers; the vulnerability affects the device's management/API interface. Consult the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09) and the Mitsubishi Electric advisory (https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information) for the authoritative list of affected products and versions.

RemediationAI

No vendor-released patch version is specified in the provided intelligence; consult the Mitsubishi Electric advisory and CISA ICSA-25-105-09 for firmware updates or patches. Until a fix is available, restrict network access to the device's management/API interface: place devices behind a firewall, segment OT networks from IT/untrusted networks, and block external access to the vulnerable API route. Disable remote management if operationally feasible, and monitor for anomalous API calls or OS command execution. These mitigations trade off reduced remote administration capability for a smaller attack surface. Apply vendor guidance as soon as it is published at the advisory URLs.