CVE-2025-5022: Mitsubishi Electric PV-DR004J · Weak Password Requirements
Affects Mitsubishi Electric PV-DR004JSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mitsubishi Electric Corporation PV-DR004J | Affected
| Fixed in– |
AI-suggested
Given the affected products are discontinued and unsupported, organizations should prioritize the following mitigations: 1) Physically secure the locations of the photovoltaic system monitors to prevent unauthorized proximity access to their Wi-Fi communications. 2) Disable the individual air conditioner control function if it is not essential, as this reduces the attack surface by preventing command injection via ECHONET Lite. 3) Where possible, replace the affected PV-DR004J and PV-DR004JA units with newer, supported models that implement stronger password policies and encrypted communications. 4) Implement network segmentation and Wi-Fi access controls to restrict access to the communication channels between units, such as using dedicated secure Wi-Fi networks with strong encryption and authentication. 5) Monitor network traffic for unusual ECHONET Lite commands or unauthorized access attempts to detect exploitation attempts. 6) Educate facility staff about the risks of unauthorized physical access near these devices. 7) If replacement is not immediately feasible, consider deploying external security controls such as Wi-Fi intrusion detection systems or RF shielding to limit attack range. These steps go beyond generic advice by focusing on compensating controls given the lack of patches and the physical proximity requirement.
Description
Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to derive the password from the SSID. In addition, if the product is configured to enable the individual air conditioner control function, an attacker who has access to the Wi-Fi communication between the units by exploiting this vulnerability may be able to execute ECHONET Lite commands to perform operations such as turning the air conditioner on or off and changing the set temperature. The individual air conditioner control function is available only in display unit version 02.00.01 or later and measurement unit version 02.03.01 or later. The affected products discontinued in 2015, support ended in 2020.