# Mitsubishi CNC Series DoS Flaw Patched

Published: 2026-08-27 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/7cc4a08a-2997-56e5-81cd-6c1461f7e0d4/mitsubishi-cnc-series-dos-flaw-patched

> A remote out-of-bounds read vulnerability in multiple Mitsubishi Electric CNC controller series can cause a denial-of-service condition; vendor fixes and mitigations are available.

CISA republished a Mitsubishi Electric advisory (2025-022) covering an Improper Validation of Specified Index, Position, or Offset in Input vulnerability (CWE-1285, tracked as CVE-2025-2399) affecting a broad range of Mitsubishi Electric CNC series controllers, including the M800V/M80V, M800/M80/E80/C80, and M700V/E70 series. A remote, unauthenticated attacker can trigger the flaw by sending specially crafted packets to TCP port 683, causing an out-of-bounds read that results in a denial-of-service condition on the affected device.

The advisory lists numerous specific firmware version ranges as vulnerable across product lines used in critical manufacturing environments worldwide. Mitsubishi Electric has released fixed firmware versions for each affected product line and recommends applying them via authorized representatives. For systems that cannot be immediately patched, the vendor and CISA recommend standard ICS network hardening: isolating control networks from the internet and business networks, using firewalls/VPNs for any required remote access, employing the built-in IP address filtering function where available, restricting physical access, and running endpoint protection on systems that can reach the affected devices.

There is no indication in the advisory of active exploitation in the wild; this is a vendor-reported vulnerability disclosed responsibly to CISA. The primary risk is availability disruption to CNC-based manufacturing operations rather than data compromise or remote code execution, making this a routine but noteworthy patch-management item for critical manufacturing operators running Mitsubishi Electric CNC equipment.

## Mentioned in this report

- Vulnerabilities: CVE-2025-2399

## Detection guidance (public sample)

### Network Connection to Mitsubishi CNC Controller Port (TCP/683) from Non-Engineering Host

ATT&CK: T0868

Detects outbound connections to TCP/683, the service port used by Mitsubishi Electric CNC controllers (M800/M80/E80/C80, M700V/E70 series) exploitable via CVE-2025-2399; connections from hosts outside the recognised engineering/HMI workstation set may indicate reconnaissance or exploitation staging against CNC availability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Network Connection to Mitsubishi CNC Controller Port (TCP/683) from Non-Engineering
  Host
description: Flags network connections to TCP/683, the port exposed by Mitsubishi
  Electric CNC series controllers vulnerable to CVE-2025-2399 (out-of-bounds read
  via crafted packets leading to DoS). Generalises on the well-known control-protocol
  port rather than any packet content, since the advisory does not describe a distinctive
  payload signature. Intended to surface hosts other than known engineering workstations/historians
  reaching this port, which may indicate probing of CNC operating state or staging
  for a DoS attempt.
tags:
- attack.discovery
- attack.t0868
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 683
    Initiated: 'true'
  filter_known_engineering_hosts:
    Image|endswith:
    - \GX Works2.exe
    - \GX Works3.exe
    - \MELSOFT\NC Configurator2.exe
  condition: selection and not filter_known_engineering_hosts
falsepositives:
- Legitimate engineering workstation or MELSOFT/GX Works software polling CNC controllers
  for status
- Network monitoring/asset discovery tools scanning the OT subnet on scheduled intervals
level: medium
id: 2e2560fb-9eb4-554c-98b7-210c50caee7c
status: experimental
author: Vorant
```

### Possible Denial-of-Service Traffic Pattern Against Mitsubishi CNC Controller (TCP/683)

ATT&CK: T0814

Detects a burst of connection attempts to the Mitsubishi CNC control port (TCP/683) from a single source, consistent with sending repeated malformed/crafted packets to trigger the CVE-2025-2399 out-of-bounds read DoS; the volume/rate threshold should be enforced by the SIEM's correlation layer (e.g., more than 20 distinct connection attempts to the same destination:683 within 60 seconds), not encoded in this per-event rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Denial-of-Service Traffic Pattern Against Mitsubishi CNC Controller
  (TCP/683)
description: Flags individual connection events to TCP/683 (Mitsubishi CNC controller
  service port affected by CVE-2025-2399) that should be evaluated by the SIEM correlation/UEBA
  layer for burst behaviour - e.g., many short-lived or failed connection attempts
  from the same source to the same CNC host within a short window, consistent with
  a DoS attempt exploiting the out-of-bounds read flaw. This rule intentionally matches
  on the single-event pattern; the rate/burst threshold constraint must be applied
  downstream since aggregation syntax is not used here.
tags:
- attack.impact
- attack.t0814
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 683
  condition: selection
falsepositives:
- Normal polling cycles from SCADA/HMI software that periodically reconnect to CNC
  controllers
- Network health-check or monitoring probes configured to test port availability
level: medium
id: 234839fe-121a-51a6-8ee6-f378f1a838ab
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7cc4a08a-2997-56e5-81cd-6c1461f7e0d4/mitsubishi-cnc-series-dos-flaw-patched.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup