CVE-2025-5023

Status: DeferredHigh (7.1)—

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. The affected products discontinued in 2015, support ended in 2020.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Base score: 7.1

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.23%
Percentile among all scored CVEs: 13
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement75 %
Primary impactT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access80 %
Secondary impactT1005 Data from Local Systemcollection75 %
Secondary impactT1565.001 Stored Data Manipulationimpact70 %

AV:A sin privilegios previos → T1210 (red adyacente). Credenciales hardcoded T1078.001. Acceso a datos de generación y venta (T1005). Capacidad de modificar/destruir información (T1565.001).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Password Policies Remote Data Storage

Affected technologies (2)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Mitsubishielectric — Ecoguidetab Pv-dr004j^AI Mitsubishielectric — Ecoguidetab Pv-dr004ja^AI

CWEs

CWE-798

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-5023",
  "cveTags": [
    {
      "tags": [
        "unsupported-when-assigned"
      ],
      "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5023",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-10T14:03:35.221730Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "PV-DR004J",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "PV-DR004JA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-10T09:15:30.623",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU90283680/",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-007_en.pdf",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. The affected products discontinued in 2015, support ended in 2020."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de uso de credenciales codificadas en el monitor del sistema fotovoltaico “EcoGuideTAB” de Mitsubishi Electric Corporation (PV-DR004J y PV-DR004JA en todas sus versiones) permite a un atacante dentro del rango de comunicación Wi-Fi entre las unidades del producto (unidad de medición y unidad de visualización) divulgar información, como la energía generada y la electricidad vendida a la red eléctrica, almacenada en el producto, manipular o destruir información almacenada o configurada en el producto, o provocar una denegación de servicio (DoS) en el producto mediante el uso de un ID de usuario y una contraseña codificados, comunes a la serie del producto, obtenidos mediante la explotación de CVE-2025-5022. Sin embargo, el producto no se ve afectado por esta vulnerabilidad si permanece sin uso durante un período determinado (predeterminado: 5 minutos) y entra en modo de ahorro de energía con la pantalla LCD de la unidad de visualización apagada. Los productos afectados se discontinuaron en 2015 y el soporte técnico finalizó en 2020."
    }
  ],
  "lastModified": "2026-06-17T09:47:02.840",
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}