CVE-2025-2399
Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Mitsubishi Electric CNC M800V Series M800VW Mitsubishi Electric Corporation |
System Number BND-2051W000 versions BB and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M800V Series M800VS Mitsubishi Electric Corporation |
System Number BND-2052W000 versions BB and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M80V Series M80V Mitsubishi Electric Corporation |
System Number BND-2053W000 versions BB and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M80V Series M80VW Mitsubishi Electric Corporation |
System Number BND-2054W000 versions BB and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M800 Series M800W Mitsubishi Electric Corporation |
System Number BND-2005W000 versions FM and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M800 Series M800S Mitsubishi Electric Corporation |
System Number BND-2006W000 versions FM and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M80 Series M80 Mitsubishi Electric Corporation |
System Number BND-2007W000 versions FM and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M80 Series M80W Mitsubishi Electric Corporation |
System Number BND-2008W000 versions FM and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC E80 Series E80 Mitsubishi Electric Corporation |
System Number BND-2009W000 versions FM and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC C80 Series C80 Mitsubishi Electric Corporation |
System Number BND-2036W000 versions BK and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M750VW Mitsubishi Electric Corporation |
System Number BND-1015W002 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M720VW Mitsubishi Electric Corporation |
System Number BND-1015W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M730VW Mitsubishi Electric Corporation |
System Number BND-1015W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M720VS Mitsubishi Electric Corporation |
System Number BND-1012W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M730VS Mitsubishi Electric Corporation |
System Number BND-1012W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M700V Series M750VS Mitsubishi Electric Corporation |
System Number BND-1012W002 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC M70V Series M70V Mitsubishi Electric Corporation |
System Number BND-1018W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Mitsubishi Electric CNC E70 Series E70 Mitsubishi Electric Corporation |
System Number BND-1022W000 versions LJ and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 5.9 medium |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA: Mitsubishi |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-022_en.pdfCNA: Mitsubishi · vendor-advisory
- https://jvn.jp/vu/JVNVU95523788/CNA: Mitsubishi · government-resource
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.