No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Anton Dorfman (Positive Technologies)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-0802 | CWE-468 Incorrect Pointer Scaling | 9.8 Critical |
In the Mitsubishi Electric MELSEC-Q/L Series a remote attacker may be able to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet. Mitigation: Mitsubishi Electric released the fixed version of the product: Vendor fix: MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Affected, fixed & timelineAffected:
Mitigation: MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later Mitigation: Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Mitigation: Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer that can access the affected product. Mitigation: For specific additional details, see Mitsubishi Electric advisory 2023-024. |
| CVE-2024-0803 | CWE-190 Integer Overflow or Wraparound | 9.8 Critical |
In the Mitsubishi Electric MELSEC-Q/L Series a remote attacker may be able to execute malicious code on a target product by sending a specially crafted packet Mitigation: Mitsubishi Electric released the fixed version of the product: Vendor fix: MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Affected, fixed & timelineAffected:
Mitigation: MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later Mitigation: Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Mitigation: Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer that can access the affected product. Mitigation: For specific additional details, see Mitsubishi Electric advisory 2023-024. |
| CVE-2024-1915 | CWE-468 Incorrect Pointer Scaling | 9.8 Critical |
In the Mitsubishi Electric MELSEC-Q/L Series a remote attacker may be able to execute malicious code on a target product by sending a specially crafted packet Mitigation: Mitsubishi Electric released the fixed version of the product: Vendor fix: MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Affected, fixed & timelineAffected:
Mitigation: MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later Mitigation: Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Mitigation: Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer that can access the affected product. Mitigation: For specific additional details, see Mitsubishi Electric advisory 2023-024. |
| CVE-2024-1916 | CWE-190 Integer Overflow or Wraparound | 9.8 Critical |
In the Mitsubishi Electric MELSEC-Q/L Series a remote attacker may be able to execute malicious code on a target product by sending a specially crafted packet Mitigation: Mitsubishi Electric released the fixed version of the product: Vendor fix: MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Affected, fixed & timelineAffected:
Mitigation: MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later Mitigation: Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Mitigation: Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer that can access the affected product. Mitigation: For specific additional details, see Mitsubishi Electric advisory 2023-024. |
| CVE-2024-1917 | CWE-190 Integer Overflow or Wraparound | 9.8 Critical |
In the Mitsubishi Electric MELSEC-Q/L Series a remote attacker may be able to execute malicious code on a target product by sending a specially crafted packet Mitigation: Mitsubishi Electric released the fixed version of the product: Vendor fix: MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Affected, fixed & timelineAffected:
Mitigation: MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later Mitigation: MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later Mitigation: Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series. Mitigation: Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls. Mitigation: Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it. Mitigation: Install antivirus software on your personal computer that can access the affected product. Mitigation: For specific additional details, see Mitsubishi Electric advisory 2023-024. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-0802 | 9.8 Critical | Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenti… |
| CVE-2024-0803 | 9.8 Critical | Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unaut… |
| CVE-2024-1915 | 9.8 Critical | Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenti… |
| CVE-2024-1916 | 9.8 Critical | Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unaut… |
| CVE-2024-1917 | 9.8 Critical | Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unaut… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.