All CISA Advisories, EN

Mitsubishi Electric MELSEC iQ-R Series

View CSAF

Summary

Successful exploitation of this vulnerability may allow an attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial-of-service condition on the affected product.

The following versions of Mitsubishi Electric MELSEC iQ-R Series are affected:

  • MELSEC iQ-R Series R08/16/32/120PCPU firmware <=48 (CVE-2025-15080)
CVSS Vendor Equipment Vulnerabilities
v3 9.4 Mitsubishi Electric Mitsubishi Electric MELSEC iQ-R Series Improper Validation of Specified Quantity in Input

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Japan

Vulnerabilities

Expand All +

CVE-2025-15080

An information disclosure, information tampering, and denial-of-service vulnerability exists in Mitsubishi Electric proprietary protocol communication and SLMP communication used in FA products. An attacker may be able to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial-of-service condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.

View CVE Details

Affected Products

Mitsubishi Electric MELSEC iQ-R Series
Vendor:
Mitsubishi Electric
Product Version:
Mitsubishi Electric MELSEC iQ-R Series R08/16/32/120PCPU firmware: <=48
Product Status:
known_affected
Remediations

Mitigation
Mitsubishi Electric recommends users of the affected products follow the procedure below to update firmware version 49 or later. Download the update file for the fixed version, the engineering software for firmware upgrade, and the manual from the download website at https://www.mitsubishielectric.com/fa/download/index.html . For details on updating the firmware, see MELSEC iQ-R Module Configuration Manual “Appendix 2 Firmware Update Function”.

Mitigation
Mitsubishi Electric recommends the following mitigations to reduce the risk of exploiting this vulnerability: Use a firewall or virtual private network (VPN) block access from untrusted networks and hosts using a firewall. Use the product within a LAN and block access from untrusted networks and hosts through a firewall. Use firewalls, IP filters, and similar controls to minimize connections to the product and prevent access from untrusted networks and hosts. For details on the IP filter function, refer to “IP Filter” in section 1.13, Security, of the MELSEC iQ-R Ethernet User’s Manual (Application). Restrict physical access to the affected product and its connected LAN.

Mitigation
For specific update instructions and additional details see the Mitsubishi Electric advisory at https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-020_en.pdf .

Mitigation
For further information, contact your local Mitsubishi Electric representative at https://www.mitsubishielectric.com/fa/service-support/index.html .

Relevant CWE: CWE-1284 Improper Validation of Specified Quantity in Input

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.4 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Acknowledgments

  • Mitsubishi Electric reported this vulnerability to CISA

Legal Notice

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: