CVE-2025-3232 HIGH

CVE-2025-3232: Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function

Vendor Mitsubishi Electric Europe
Product smartRTU
Weakness CWE-306 · Missing auth
Published December 24, 2025
Last update December 24, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.

Key dates

02Disclosure timeline

December 24, 2025 CVE published
December 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-3531 Cisco IoT Field Network Director Unauthenticated REST API Vulnerability CVE-2024-21619 Junos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive information CVE-2025-13483 Missing Authentication for Critical Function in SiRcom SMART Alert (SiSA) CVE-2019-25483 Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell Escape CVE-2023-24526 Improper Access Control in SAP NetWeaver AS Java (Classload Service)