Skip to content
Fencer Intel
medium 6.8

CVE-2025-8531 json

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU,…

published last yr. modified 4mo ago also EUVD-2025-30300

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.

Is CVE-2025-8531 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-266-02 updated cvss 6.8

Mitsubishi Electric MELSEC-Q Series CPU Module

  • Mitsubishi Electric MELSEC-Q Series Q03UDVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q03UDVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q04UDPVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q04UDPVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q04UDVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q04UDVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q06UDPVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q06UDPVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q06UDVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q06UDVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q13UDPVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q13UDPVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q13UDVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q13UDVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
  • Mitsubishi Electric MELSEC-Q Series Q26UDPVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q26UDPVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com
show 1 more
  • Mitsubishi Electric MELSEC-Q Series Q26UDVCPU >=The_first_5_digits_of_serial_No._'24082', <'27081'
    affected: mitigation “MELSEC-QSeries Q26UDVCPU: The first 5 digits of serial No. '27082' or later.” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

  • Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q04UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q06UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q13UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q26UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q04UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q06UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q13UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q26UDPVCPU

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.