Loading story…
CISA issued multiple advisories covering vulnerabilities in Mitsubishi Electric industrial control system products, including MELFA SD/SQ and F-series robot controllers, MELSEC iQ-F, iQ-R, Q, L series, and MELIPC platforms. The most severe issues included remotely exploitable authentication weaknesses in factory automation devices and an authentication bypass in robot controllers caused by active debug code, tracked as CVE-2022-33323, which could permit unauthorized telnet access. Other flaws, including CVE-2022-25155 through CVE-2022-25160, involved weak or improper authentication handling, cleartext storage of sensitive information, and capture-replay abuse that could let unauthenticated attackers log in, disclose data, tamper with product information, or impersonate legitimate users.
A separate advisory also warned that multiple Intel third-party component vulnerabilities affected Mitsubishi Electric factory automation products, creating risks including privilege escalation, parameter disclosure, and denial of service, with a worst-case CVSS v3 8.8. Mitsubishi Electric released firmware updates or mitigation guidance and directed customers to vendor bulletins and Intel advisories where applicable. CISA urged operators to limit network exposure, isolate control systems from business networks, use firewalls or VPNs for remote access, restrict physical access where relevant, and follow standard ICS hardening practices. The advisories said no known public exploits were specifically targeting these vulnerabilities at the time of publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA published Update D for a critical classic buffer overflow vulnerability, CVE-2023-1424, affecting multiple Mitsubishi Electric MELSEC iQ-F and iQ-R Series CPU modules. Mitsubishi Electric released fixed firmware for many models and provided mitigations for unsupported products; CISA said no known public exploitation had been reported.
CISA published an advisory covering multiple Intel third-party component vulnerabilities affecting Mitsubishi Electric MELIPC, MELSEC iQ-R, and MELSEC Q Series products. The issues could enable privilege escalation, disclosure of parameter information, or denial of service, and Mitsubishi Electric directed users to Intel advisories and its own bulletin for mitigations.
CISA published an advisory for CVE-2022-33323 affecting Mitsubishi Electric MELFA SD/SQ series and F-series robot controllers, where active debug code enabled unauthorized telnet login and remote authentication bypass. Mitsubishi Electric released updated firmware and advised customers to restrict network exposure and use firewalls or VPNs for remote access.
CISA published Update A for Mitsubishi Electric FA products, detailing multiple remotely exploitable authentication and sensitive information handling flaws affecting MELSEC iQ-F, iQ-R, Q, and L series devices. The vulnerabilities could allow unauthenticated attackers to log in, disclose sensitive information, tamper with data, or impersonate legitimate users; no known public exploits were reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued multiple ICS advisories covering **Mitsubishi Electric MELSEC** controllers used in critical manufacturing, warning that several product lines are exposed to remotely exploitable flaws. The most severe issues affect **MELSEC-Q/L Series** factory automation controllers, where five vulnerabilities—`CVE-2024-0802`, `CVE-2024-0803`, `CVE-2024-1915`, `CVE-2024-1916`, and `CVE-2024-1917`—carry **CVSS 9.8** ratings and could let an attacker read arbitrary information or execute malicious code by sending crafted packets. Mitsubishi released remediated versions tied to newer serial-number ranges, and CISA said no public exploitation had been reported at publication. Separate advisories also warned that **MELSEC iQ-R Series Safety CPU and SIL2 Process CPU** modules contain flaws that can expose usernames through brute-force attempts (`CVE-2021-20594`), leak credentials via network sniffing (`CVE-2021-20597`), and lock out legitimate users after repeated failed logins (`CVE-2021-20598`). In addition, **MELSEC iQ-R, Q, and L Series** CPU modules are affected by an uncontrolled resource consumption bug, `CVE-2020-5652`, that can trigger a denial of service on the Ethernet port until the device is reset. Mitsubishi has provided firmware fixes for many affected systems, while CISA urged operators to isolate control networks, use firewalls or VPNs, block untrusted access, and apply compensating controls for legacy devices that cannot be updated.
Jun 29, 2026
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026
CISA and Mitsubishi Electric disclosed multiple denial-of-service vulnerabilities affecting **MELSEC iQ-R** industrial controllers and related modules used in the critical manufacturing sector. The issues include improper input validation in `CVE-2022-40265`, improper session management in `CVE-2021-20591`, and uncontrolled resource consumption flaws tracked as `CVE-2020-5666` and `CVE-2020-5527`. The vulnerabilities can be exploited remotely in various configurations to disrupt communications, block legitimate client connections, or force affected devices into an unresponsive state that may require a system reset or port recovery. Affected products span MELSEC iQ-R CPU modules, Ethernet interfaces, C Controller modules, and broader MELSEC controller families including **iQ-F, Q, L, and F series** in some cases. Mitsubishi Electric issued firmware updates and mitigations such as disabling unnecessary web server functions, upgrading to fixed firmware, restricting network access with firewalls and IP filtering, and limiting exposure to trusted LAN environments or VPN-protected remote access. CISA also urged operators to isolate control systems from business networks and reduce Internet exposure; at the time of the advisories, no known public exploits were reported as specifically targeting these flaws.
Jun 29, 2026