Mitsubishi Electric MELSOFT iQ AppPortal

MELSOFT iQ AppPortal versions 1.00A through 1.29F contain multiple vulnerabilities in HTTP request handling and authentication logic (CWE-444, CWE-345). These flaws could allow an attacker on the network to bypass authentication, disclose sensitive information, cause denial-of-service, or bypass IP address-based access controls. The vulnerabilities are not remotely exploitable without network access to the application server, and no public exploits are known. Mitsubishi Electric recommends updating to version 1.32J or later. Until patching is possible, disable mod_proxy and mod_proxy_ajp features, restrict network access via firewall to trusted hosts only, use VPN for remote access, and apply the principle of least privilege to user accounts.