Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.

An information disclosure, information tampering, and denial-of-service vulnerability exists in MELSEC iQ-F series CPU module due to missing authentication for critical function. Since MODBUS/TCP in the products does not have authentication features, an attacker may be able to read or write the device values of the product. In addition, the attacker may be able to stop the operation of the programs.