Vulnerability in Mitsubishi Electric Corporation Melsec-Q Series Q03udvcpu
CVE-2025-8531
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.
EPSS: 0.010 (57.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Mitsubishi Electric Corporation Melsec-q Series Q03udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q04udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q04udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q06udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q06udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q13udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q13udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q26udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-q Series Q26udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
Weakness classification (CWE)
References
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (vendor-advisory)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (government-resource)
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (government-resource)
Frequently asked questions
- What is CVE-2025-8531?
- CVE-2025-8531 is a medium-severity vulnerability in Mitsubishi Electric Corporation Melsec-Q Series Q03udvcpu, classified under Improper Handling of Length Parameter Inconsistency. CVSS score: 6.8/10. Published 2025-09-19.
- How severe is CVE-2025-8531?
- Medium severity. CVSS v3 base score is 6.8 out of 10.