Mitsubishi Electric PV-DR004J/PV-DR004JA hard-coded credentials

Summaryinfo

A vulnerability marked as critical has been reported in Mitsubishi Electric PV-DR004J and PV-DR004JA. Affected is an unknown function. Performing a manipulation results in hard-coded credentials. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2025-5023. The attack needs to be approached within the local network. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Mitsubishi Electric PV-DR004J and PV-DR004JA (the affected version is unknown). This affects an unknown code. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. However, the product is not affected by this vulnerability when it remains unused for a certain period of time (default: 5 minutes) and enters the power-saving mode with the display unit's LCD screen turned off. The affected products discontinued in 2015, support ended in 2020.

It is possible to read the advisory at mitsubishielectric.com. This vulnerability is uniquely identified as CVE-2025-5023 since 05/21/2025. The exploitability is told to be easy. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20984). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Mitsubishi Electric

Name

• PV-DR004J
• PV-DR004JA

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion