# Mitsubishi Electric MELSEC-Q PLCs remote denial of service

Published: 2025-06-24 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/dd89df11-fee2-5328-987c-ce2bdb93f580/mitsubishi-electric-melsec-q-plcs-remote-denial-of-service

> Resource exhaustion vulnerability in Mitsubishi MELSEC-Q series PLCs allows remote attackers to crash Ethernet and USB communications.

A resource exhaustion vulnerability (CVE-2019-6535, CVSS 7.5) affects multiple Mitsubishi Electric MELSEC-Q series programmable logic controllers. A remote attacker can send specially crafted packets over Ethernet to crash both Ethernet and USB communication on the affected devices, causing a denial of service. The vulnerability requires no authentication or user interaction and is remotely exploitable with low skill level.

Affected models include Q03/04/06/13/26UDVCPU (serial 20081 and prior), Q04/06/13/26UDPVCPU (serial 20081 and prior), and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU (serial 20101 and prior). Mitsubishi Electric has released patched firmware. CISA reports no known active exploitation at time of advisory publication, though the vulnerability was initially reported in January 2019 and most recently updated in June 2025.

Defenders should prioritize patching affected systems and ensuring PLCs operate behind firewalls with restricted network access. Remote access should be secured via VPN or other protected channels. The vulnerability affects critical manufacturing infrastructure globally.

## Mentioned in this report

- Vulnerabilities: CVE-2019-6535

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dd89df11-fee2-5328-987c-ce2bdb93f580/mitsubishi-electric-melsec-q-plcs-remote-denial-of-service.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup