5 minmedium
Mitsubishi Electric CNC Series (Update A) (CVE-2025-2399)
A vulnerability (CVE-2025-2399) in Mitsubishi Electric CNC Series devices allows remote attackers to trigger a denial-of-service condition via an out-of-bounds read. The flaw is exploited by sending specially crafted packets to TCP port 683. Multiple models across several product series are affected, with vendor fixes available for most.
Conf:highAnalyzed:2026-08-27openrouter
Showing defanged values
- cveCVE-2025-2399Improper validation of specified index, position, or offset in input allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition via crafted packets to TCP port 683.
Detection / Hunteropenrouter
What Happened
Mitsubishi Electric found a flaw in some of its industrial control devices called CNC Series. A remote attacker could send specially crafted network messages to crash the device, causing a denial-of-service. This affects devices used in critical manufacturing worldwide. Organizations should update their devices to the latest firmware versions or use firewalls and network restrictions to protect them.
Key Takeaways
- CVE-2025-2399 is an improper validation vulnerability in Mitsubishi Electric CNC Series devices that allows remote attackers to cause a denial-of-service condition.
- The vulnerability is triggered by sending specially crafted packets to TCP port 683, resulting in an out-of-bounds read.
- Multiple models across the M800/M80/E80 and M700/M70/E70 series are affected, with specific firmware versions requiring updates.
- Mitigations include applying vendor fixes, using firewalls/VPNs, restricting network access, and enabling IP filter functions where available.
Affected Systems
- Mitsubishi Electric M800VW (BND-2051W000) <=BB
- Mitsubishi Electric M800VS (BND-2052W000) <=BB
- Mitsubishi Electric M80V (BND-2053W000) <=BB
- Mitsubishi Electric M80VW (BND-2054W000) <=BB
- Mitsubishi Electric M800W (BND-2005W000) <=FM
- Mitsubishi Electric M800S (BND-2006W000) <=FM
- Mitsubishi Electric M80 (BND-2007W000) <=FM
- Mitsubishi Electric M80W (BND-2008W000) <=FM
- Mitsubishi Electric E80 (BND-2009W000) <=FM
- Mitsubishi Electric C80 (BND-2036W000) vers:all/*
- Mitsubishi Electric M750VW (BND-1015W002) <=LJ
- Mitsubishi Electric M730VW (BND-1015W000) <=LJ
- Mitsubishi Electric M720VW (BND-1015W000) <=LJ
- Mitsubishi Electric M750VS (BND-1012W002) <=LJ
- Mitsubishi Electric M730VS (BND-1012W000) <=LJ
- Mitsubishi Electric M720VS (BND-1012W000) <=LJ
- Mitsubishi Electric M70V (BND-1018W000) <=LJ
- Mitsubishi Electric E70 (BND-1022W000) <=LJ
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-2399 | Mitsubishi Electric CNC Series | Medium | Improper validation of specified index, position, or offset in input allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition via crafted packets to TCP port 683. |
Attack Chain
- Reconnaissance: Attacker identifies Mitsubishi Electric CNC devices exposed on the network.
- Initial Access: Attacker sends specially crafted packets to TCP port 683 on the target device.
- Exploitation: The improper validation of input causes an out-of-bounds read condition.
- Impact: The device enters a denial-of-service state, disrupting manufacturing operations.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the advisory.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | The vulnerability targets industrial control system (ICS) devices, which typically do not run EDR agents. |
| Network Visibility | Medium | Network monitoring could detect crafted packets targeting TCP port 683, though specific payload signatures are not provided. |
| Detection Difficulty | Moderate | Detecting the exploit requires visibility into OT network traffic and the ability to identify anomalous packets directed at TCP port 683 on specific Mitsubishi devices. |
Required Log Sources
- Firewall logs
- Network flow data
- ICS-specific network monitoring (e.g., passive network IDS for OT environments)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for inbound network connections to TCP port 683 on devices in the manufacturing or OT network segments. | Firewall logs, network flow data, or passive OT network monitoring | Initial Access | Medium - legitimate engineering or monitoring software may communicate with CNC devices on this port. |
Control Gaps
- Standard IT EDR solutions will not provide visibility into CNC device exploitation.
- Lack of network segmentation between IT and OT networks increases exposure.
Key Behavioral Indicators
- Inbound connections to TCP port 683 from untrusted or non-engineering network segments
- Unexpected device resets or crashes on Mitsubishi Electric CNC equipment
False Positive Assessment
Medium - legitimate engineering software may use TCP port 683 for device communication, making port-based detection alone insufficient for high-fidelity alerts.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Apply the vendor-provided firmware updates (BC, FN, or LK or later depending on the model) to affected CNC devices.
- If patching is not immediately possible, restrict access to TCP port 683 using firewalls or ACLs to only trusted engineering workstations.
- Enable the IP filter function on M800V/M80V and M800/M80/E80 series devices if supported.
Infrastructure Hardening
- Ensure CNC devices and control system networks are isolated from business networks and not accessible from the internet.
- Implement VPNs for remote access to OT networks, ensuring VPN appliances are fully patched.
- Restrict physical access to CNC devices and connected network equipment.
User Protection
- Install and maintain anti-virus software on PCs that can access the affected CNC products.
Security Awareness
- Train engineering and maintenance staff on the risks of connecting CNC devices to untrusted networks.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Execution
Tactic
