Vulnerability · Published Jul 10, 2025 · Assigned by Mitsubishi

CVE-2025-5023

High 7.1

In plain English

A high-severity hard-coded credentials in PV-DR004J from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 83.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. The affected products discontinued in 2015, support ended in 2020.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	PV-DR004J	All versions
Mitsubishi Electric Corporation	PV-DR004JA	All versions

Weakness: CWE-798 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

References

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-007_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU90283680/ government-resource