Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-15080

Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mitsubishi

Description

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mitsubishi Electric Corporation MELSEC iQ-R Series R08PCPU

Default version status: unaffected

  • Firmware versions "48" and prioraffected

Mitsubishi Electric Corporation MELSEC iQ-R Series R16PCPU

Default version status: unaffected

  • Firmware versions "48" and prioraffected

Mitsubishi Electric Corporation MELSEC iQ-R Series R32PCPU

Default version status: unaffected

  • Firmware versions "48" and prioraffected

Mitsubishi Electric Corporation MELSEC iQ-R Series R120PCPU

Default version status: unaffected

  • Firmware versions "48" and prioraffected

References