Skip to content
Fencer Intel
medium 5.9

CVE-2025-2399 json

Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series

published 7mo ago modified 2mo ago also EUVD-2025-208463

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683.

Is CVE-2025-2399 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-078-05 updated cvss 5.9

Mitsubishi Electric CNC Series (Update A)

  • Mitsubishi Electric C80 (BND-2036W000)
    affected: mitigation
  • Mitsubishi Electric E70 (BND-1022W000) <=LJ
    affected: vendor fix, mitigation
  • Mitsubishi Electric E80 (BND-2009W000) <=FM
    affected: vendor fix, mitigation mitsubishielectric.com
  • Mitsubishi Electric M70V (BND-1018W000) <=LJ
    affected: vendor fix, mitigation
  • Mitsubishi Electric M80 (BND-2007W000) <=FM Mitsubishi Electric M80V (BND-2053W000) <=BB Mitsubishi Electric M80VW (BND-2054W000) <=BB Mitsubishi Electric M80W (BND-2008W000) <=FM
    affected: vendor fix, mitigation mitsubishielectric.com
  • Mitsubishi Electric M720VS (BND-1012W000) <=LJ Mitsubishi Electric M720VW (BND-1015W000) <=LJ Mitsubishi Electric M730VS (BND-1012W000) <=LJ Mitsubishi Electric M730VW (BND-1015W000) <=LJ Mitsubishi Electric M750VS (BND-1012W002) <=LJ Mitsubishi Electric M750VW (BND-1015W002) <=LJ
    affected: vendor fix, mitigation
  • Mitsubishi Electric M800S (BND-2006W000) <=FM Mitsubishi Electric M800VS (BND-2052W000) <=BB Mitsubishi Electric M800VW (BND-2051W000) <=BB Mitsubishi Electric M800W (BND-2005W000) <=FM
    affected: vendor fix, mitigation mitsubishielectric.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M800V Series M800VW
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M800V Series M800VS
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M80V Series M80V
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M80V Series M80VW
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M800 Series M800W
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M800 Series M800S
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M80 Series M80
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M80 Series M80W
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC E80 Series E80
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC C80 Series C80
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M750VW
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M720VW
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M730VW
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M720VS
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M730VS
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M700V Series M750VS
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC M70V Series M70V
  • Mitsubishi Electric Corporation Mitsubishi Electric CNC E70 Series E70

Classification

Weakness
  • CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.