Vulnerability in Mitsubishi Electric Corporation Melsec-Q Series Q03udvcpu
CVE-2025-8531
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (62.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Mitsubishi Electric Corporation Melsec-Q Series Q03udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q04udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q04udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q06udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q06udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q13udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q13udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q26udpvcpu — versions The first 5 digits of serial No. "24082" to "27081"
- Mitsubishi Electric Corporation Melsec-Q Series Q26udvcpu — versions The first 5 digits of serial No. "24082" to "27081"
Weakness classification (CWE)
References
- www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-013_en.pdf (vendor-advisory)
- jvn.jp/vu/JVNVU97846038/ (government-resource)
- www.cisa.gov/news-events/ics-advisories/icsa-25-266-02 (government-resource)
Frequently asked questions
- What is CVE-2025-8531?
- CVE-2025-8531 is a medium-severity vulnerability in Mitsubishi Electric Corporation Melsec-Q Series Q03udvcpu, classified under Improper Handling of Length Parameter Inconsistency. CVSS score: 6.8/10. Published 2025-09-19.
- How severe is CVE-2025-8531?
- Medium severity. CVSS v3 base score is 6.8 out of 10.