Loading story…
CISA updated an advisory for Mitsubishi Electric FA Engineering Software to address two vulnerabilities affecting GX Works2, MELSOFT Navigator, and EZSocket. The issues, tracked as CVE-2021-20606 and CVE-2021-20607, are an out-of-bounds read and an integer underflow that can be triggered when a user opens a specially crafted malicious project file, potentially causing a denial-of-service condition.
The vulnerabilities each carry a CVSS v3 base score of 5.5 and require user interaction, limiting exploitation to scenarios where a victim opens a malicious file. Mitsubishi Electric published fixed versions and update guidance in its product security advisory, and CISA said the affected software is used in the Critical Manufacturing sector worldwide. CISA also noted that it was not aware of any public exploitation specifically targeting these flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
CISA published advisory ICSA-23-334-04 covering Mitsubishi Electric FA Engineering Software Products. This represents a new official advisory/update related to these products beyond the 2021 advisory and its 2022 Update B revision.
CISA released an updated version of advisory ICSA-21-350-05 labeled Update B for the Mitsubishi Electric FA Engineering Software vulnerabilities. The update continued to document the affected products, vulnerability details, and vendor remediation guidance.
CISA published advisory ICSA-21-350-05 covering the two Mitsubishi Electric vulnerabilities and noting the affected products are used in the Critical Manufacturing sector worldwide. CISA said there were no known public exploits specifically targeting these issues.
CISA published advisory ICSA-21-350-04 concerning Mitsubishi Electric GX Works2 on 2021-12-16. This was a separate official CISA notice from ICSA-21-350-05 issued the same day, indicating an additional distinct advisory related to Mitsubishi Electric software.
Mitsubishi Electric disclosed CVE-2021-20606 and CVE-2021-20607 affecting GX Works2, MELSOFT Navigator, and EZSocket. The flaws can be triggered by opening a specially crafted project file and may cause a denial-of-service condition; Mitsubishi provided fixed versions or update guidance.
CISA published advisory ICSA-20-182-02 covering Mitsubishi Electric Factory Automation Engineering Software Products. This is an earlier official advisory concerning these products, preceding the later 2021, 2022, and 2023 CISA notices already in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceus-cert.cisa.gov
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026
CISA issued updated advisories for multiple **Mitsubishi Electric** industrial control system products used in the **Critical Manufacturing** sector, detailing vulnerabilities that could let remote attackers disrupt operations, impersonate trusted devices, or execute malicious code. The most severe issue, `CVE-2023-3346`, is a critical classic buffer overflow in numerous Mitsubishi Electric **CNC Series** products with a **CVSS v3 9.8** score; CISA said specially crafted packets could trigger denial of service and enable unauthenticated remote code execution, with some affected systems requiring a reset to recover. Separate advisories also covered `CVE-2020-16226`, a predictable-value weakness affecting a broad range of Mitsubishi Electric automation products that could allow device impersonation, TCP session hijacking, and possible remote command execution, and two flaws in **CC-Link IE TSN Industrial Managed Switch** models `NZ2MHG-TSNT8F2` and `NZ2MHG-TSNT4`: `CVE-2022-4304`, an observable timing discrepancy that may disclose information via crafted packets, and `CVE-2022-4450`, a double-free bug that could cause denial of service through a malicious certificate import. Mitsubishi Electric has released firmware or fixed versions for affected products and urged operators to upgrade, segment control networks, limit internet exposure, and use firewalls or VPNs for remote access; CISA said it had **no evidence of public exploitation** targeting these flaws at the time of publication.
Jun 29, 2026
CISA republished Mitsubishi Electric advisories for two **high-severity denial-of-service vulnerabilities** affecting industrial control products in the **MELSEC iQ-F Series**. The flaws impact the **FX5-EIP EtherNet/IP Module** (`CVE-2026-8805`) and the **FX5-ENET/IP Ethernet Module** (`CVE-2026-8806`), both used in critical manufacturing environments. In the FX5-EIP module, a remotely reachable integer overflow in the EtherNet/IP function can be triggered by rapidly opening many TCP connections, leading to inconsistent connection handling and improper memory access. In the FX5-ENET/IP module, an expected-behavior violation can be exploited by flooding the Ethernet port with a large volume of packets, overloading processing and stopping communications while disabling internal anomaly-detection processing. CISA and Mitsubishi rated both issues **High** severity, with `CVE-2026-8806` carrying a **CVSS v4.0 score of 8.7** and affecting **all versions** of the FX5-ENET/IP module, while `CVE-2026-8805` affects **version 1.000 and earlier** of the FX5-EIP module. Recommended mitigations include applying vendor fixes where available, minimizing network exposure, isolating control systems behind firewalls, restricting access with segmentation and secure remote connectivity such as updated VPNs, and monitoring for abnormal traffic or excessive connection attempts. The disclosures follow earlier CISA advisories involving Mitsubishi MELSEC networking components, including an authentication-bypass issue in the **WS Series** Ethernet interface module (`CVE-2023-1618`).
Jul 12, 2026