CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-266-02: Mitsubishi Electric MELSEC-Q Series CPU Module ↗ source

September 23, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-02

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service (DoS). CVE-2025-8531: A Denial-of-Service (DoS) vulnerability exists in the MELSEC-Q series CPU module when the user authentication function is enabled, due to improper handling of length parameter inconsistency.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-266-02
Status
Final · version 1
Initial release
2025-09-23
Last revised
2025-09-23
Vendor
Mitsubishi Electric
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Japan

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

Credit: Mitsubishi Electric

Affected products (9)
  • MELSEC-Q Series Q03UDVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q04UDVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q06UDVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q13UDVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q26UDVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q04UDPVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q06UDPVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q13UDPVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q26UDPVCPU — >=The_first_5_digits_of_serial_No._'24082'|<'27081'

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2025-8531 CWE-130 Improper Handling of Length Parameter Inconsistency 6.8 Medium A Denial-of-Service (DoS) vulnerability exists in the MELSEC-Q series CPU module when the user authentication function is enabled, due to improper handling of length parameter inconsistency.

Mitigation: Mitsubishi Electric has released the fixed version as shown below, but updating the product to the fixed version is currently unavailable. Consider migrating to the successor model, MELSEC iQ-R Series.

Mitigation: MELSEC-QSeries Q03UDVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q04UDVCPU: The first 5 digits of serial No. '27082' or later.

Affected, fixed & timeline

Affected:

  • MELSEC-Q Series Q03UDVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q04UDVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q06UDVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q13UDVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q26UDVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q04UDPVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q06UDPVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q13UDPVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'
  • MELSEC-Q Series Q26UDPVCPU >=The_first_5_digits_of_serial_No._'24082'|<'27081'

Mitigation: MELSEC-QSeries Q06UDVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q13UDVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q26UDVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q04UDPVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q06UDPVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q13UDPVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: MELSEC-QSeries Q26UDPVCPU: The first 5 digits of serial No. '27082' or later.

Mitigation: Mitsubishi Electric recommends users employ the following mitigation measures to minimize the risk of vulnerability exploit.

Mitigation: Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls.

Mitigation: Restrict physical access to the affected products, as well as to computers and network devices that can be connected to those products.

Mitigation: See Mitsubishi Electric's security bulletin for more information.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2025-8531 6.8 Medium Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU,…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.