As cited
Copy frozen at (site build).
vulnerabilities
Mitsubishi Electric CNC Series (Update A)
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Mitsubishi Electric CNC Series (Update A)
CVE-2025-2399 is an improper input validation vulnerability in Mitsubishi Electric CNC Series controllers that allows remote attackers to trigger an out-of-bounds read by sending specially crafted packets to TCP port 683, resulting in denial of service. The vulnerability affects multiple M-series and E-series models with CVSS 5.9 (medium). Mitsubishi Electric recommends applying patched firmware versions (BC, FN, or LK depending on model line) or implementing network isolation, firewall rules, and IP filtering as interim mitigations.
Why it matters: Manufacturing facilities and critical infrastructure operators deploying Mitsubishi Electric CNC controllers must prioritize patching or segmenting these devices to prevent production disruption from remotely triggered denial-of-service attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Mitsubishi Electric CNC Series (Update A)
CVE-2025-2399 is an improper input validation vulnerability in Mitsubishi Electric CNC Series controllers that allows remote attackers to trigger an out-of-bounds read by sending specially crafted packets to TCP port 683, resulting in denial of service. The vulnerability affects multiple M-series and E-series models with CVSS 5.9 (medium). Mitsubishi Electric recommends applying patched firmware versions (BC, FN, or LK depending on model line) or implementing network isolation, firewall rules, and IP filtering as interim mitigations.
Why it matters: Manufacturing facilities and critical infrastructure operators deploying Mitsubishi Electric CNC controllers must prioritize patching or segmenting these devices to prevent production disruption from remotely triggered denial-of-service attacks.
- Source published
- First seen by Cybersecurity Tracker