Mitsubishi Electric CNC Series Vulnerability CVE-2025-2399 - Out-of-Bounds Read Risk

An industrial control systems advisory published by CISA on August 27, 2026, reveals a vulnerability affecting Mitsubishi Electric CNC Series (Update A) products. Tracked as CVE-2025-2399, the flaw involves improper validation of specified index, position, or offset in input (CWE-1285).

The vulnerability is present across numerous Mitsubishi Electric CNC controller models. Affected product lines include the M800 series (M800VW, M800VS, M800W, M800S), M80 series (M80V, M80VW, M80, M80W), E80, C80, and M700/E70 series (M750VW, M730VW, M720VW, M750VS, M730VS, M720VS, M70V, E70). Version thresholds vary by model: some require updates to BC or later, others to FN or LK or later.

Technical analysis indicates that a remote attacker could exploit this condition by sending specially crafted packets to TCP port 683 of the affected device. Successful exploitation would trigger an out-of-bounds read, leading to a denial-of-service condition that could crash the CNC controller. The advisory notes that no public exploit code was confirmed at the time of publication, and active exploitation in the wild has not been reported.

The vulnerability impacts Critical Manufacturing sector infrastructure, with Mitsubishi Electric products deployed worldwide. The CVSS v3 base score is 5.9 (Medium severity), reflecting the availability impact of the denial-of-service condition rather than confidentiality or integrity impacts.

Mitsubishi Electric has issued vendor fixes requiring specific version upgrades. For M800VW, M800VS, M80V, and M80VW models, the fixed version is BC or later. For M800W, M800S, M80, M80W, and E80 models, the fixed version is FN or later. For M750VW, M730VW, M720VW, M750VS, M730VS, M720VS, M70V, and E70 models, the fixed version is LK or later. The vendor also recommends using firewalls or VPNs to prevent unauthorized access and operating products within trusted LAN environments when internet access is required.

Security researchers and industrial control system operators are advised to review the CISA advisory and Mitsubishi Electric's guidance to determine applicable patches and mitigation steps for their specific equipment configurations.