Improper Handling of Length Parameter Inconsistency in Mitsubishi Electric MELSEC-Q Series
CVE-2025-8531
Key Information:
- Status
- Vendor
- CVE Published:
- 19 September 2025
What is CVE-2025-8531?
A vulnerability exists within the Mitsubishi Electric MELSEC-Q Series products due to improper handling of length parameter inconsistencies. Specifically, affected models can experience integer underflows when they receive specially crafted packets. This can lead to a disruption in Ethernet communications and the execution of control programs, especially when the user authentication function is enabled. Notably, this user authentication is enabled by default only under certain configurations with GX Works2, which is compliant with the Cybersecurity Law of the People's Republic of China.
Affected Version(s)
MELSEC-Q Series Q03UDVCPU The first 5 digits of serial No. "24082" to "27081"
MELSEC-Q Series Q04UDPVCPU The first 5 digits of serial No. "24082" to "27081"
MELSEC-Q Series Q04UDVCPU The first 5 digits of serial No. "24082" to "27081"