Mitsubishi CNC Series DoS Flaw Patched
A remote out-of-bounds read vulnerability in multiple Mitsubishi Electric CNC controller series can cause a denial-of-service condition; vendor fixes and mitigations are available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished a Mitsubishi Electric advisory (2025-022) covering an Improper Validation of Specified Index, Position, or Offset in Input vulnerability (CWE-1285, tracked as CVE-2025-2399) affecting a broad range of Mitsubishi Electric CNC series controllers, including the M800V/M80V, M800/M80/E80/C80, and M700V/E70 series. A remote, unauthenticated attacker can trigger the flaw by sending specially crafted packets to TCP port 683, causing an out-of-bounds read that results in a denial-of-service condition on the affected device.
The advisory lists numerous specific firmware version ranges as vulnerable across product lines used in critical manufacturing environments worldwide. Mitsubishi Electric has released fixed firmware versions for each affected product line and recommends applying them via authorized representatives. For systems that cannot be immediately patched, the vendor and CISA recommend standard ICS network hardening: isolating control networks from the internet and business networks, using firewalls/VPNs for any required remote access, employing the built-in IP address filtering function where available, restricting physical access, and running endpoint protection on systems that can reach the affected devices.
There is no indication in the advisory of active exploitation in the wild; this is a vendor-reported vulnerability disclosed responsibly to CISA. The primary risk is availability disruption to CNC-based manufacturing operations rather than data compromise or remote code execution, making this a routine but noteworthy patch-management item for critical manufacturing operators running Mitsubishi Electric CNC equipment.
Mentioned in this report
Detection guidance
Network Connection to Mitsubishi CNC Controller Port (TCP/683) from Non-Engineering Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects outbound connections to TCP/683, the service port used by Mitsubishi Electric CNC controllers (M800/M80/E80/C80, M700V/E70 series) exploitable via CVE-2025-2399; connections from hosts outside the recognised engineering/HMI workstation set may indicate reconnaissance or exploitation staging against CNC availability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Connection to Mitsubishi CNC Controller Port (TCP/683) from Non-Engineering
Host
description: Flags network connections to TCP/683, the port exposed by Mitsubishi
Electric CNC series controllers vulnerable to CVE-2025-2399 (out-of-bounds read
via crafted packets leading to DoS). Generalises on the well-known control-protocol
port rather than any packet content, since the advisory does not describe a distinctive
payload signature. Intended to surface hosts other than known engineering workstations/historians
reaching this port, which may indicate probing of CNC operating state or staging
for a DoS attempt.
tags:
- attack.discovery
- attack.t0868
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 683
Initiated: 'true'
filter_known_engineering_hosts:
Image|endswith:
- \GX Works2.exe
- \GX Works3.exe
- \MELSOFT\NC Configurator2.exe
condition: selection and not filter_known_engineering_hosts
falsepositives:
- Legitimate engineering workstation or MELSOFT/GX Works software polling CNC controllers
for status
- Network monitoring/asset discovery tools scanning the OT subnet on scheduled intervals
level: medium
id: 2e2560fb-9eb4-554c-98b7-210c50caee7c
status: experimental
author: Vorant
Possible Denial-of-Service Traffic Pattern Against Mitsubishi CNC Controller (TCP/683)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a burst of connection attempts to the Mitsubishi CNC control port (TCP/683) from a single source, consistent with sending repeated malformed/crafted packets to trigger the CVE-2025-2399 out-of-bounds read DoS; the volume/rate threshold should be enforced by the SIEM's correlation layer (e.g., more than 20 distinct connection attempts to the same destination:683 within 60 seconds), not encoded in this per-event rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Denial-of-Service Traffic Pattern Against Mitsubishi CNC Controller
(TCP/683)
description: Flags individual connection events to TCP/683 (Mitsubishi CNC controller
service port affected by CVE-2025-2399) that should be evaluated by the SIEM correlation/UEBA
layer for burst behaviour - e.g., many short-lived or failed connection attempts
from the same source to the same CNC host within a short window, consistent with
a DoS attempt exploiting the out-of-bounds read flaw. This rule intentionally matches
on the single-event pattern; the rate/burst threshold constraint must be applied
downstream since aggregation syntax is not used here.
tags:
- attack.impact
- attack.t0814
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 683
condition: selection
falsepositives:
- Normal polling cycles from SCADA/HMI software that periodically reconnect to CNC
controllers
- Network health-check or monitoring probes configured to test port availability
level: medium
id: 234839fe-121a-51a6-8ee6-f378f1a838ab
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-05
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs