Mitsubishi Electric CNC Series (Update A)
CISA's updated ICS advisory details CVE-2025-2399, an out-of-bounds read in Mitsubishi Electric CNC series that lets a remote attacker cause a denial-of-service condition.
CISA released Update A of ICS advisory ICSA-26-078-05 covering Mitsubishi Electric CNC series controllers. The vulnerability CVE-2025-2399 is an out-of-bounds read that a remote attacker can exploit to trigger a denial-of-service condition. Affected products include M800VW, M800VS, M80V, M80VW, M800W, M800S and M80 series controllers up to specified firmware revisions. No exploitation is reported in the advisory.
- Out-of-bounds read (CVE-2025-2399) enables remote denial-of-service
- Affects multiple Mitsubishi CNC controller families including M800 and M80 series
- Update A advisory with vendor firmware fixes available
- CVEs
- CVE-2025-2399
- Vendors
- Mitsubishi Electric
- Products
- Mitsubishi Electric CNC Series
- Organizations
- CISA
- Countries
- Japan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-2399 | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V… | 5.9 | <1% |
From the original article
View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.