Loading story…
CISA and Mitsubishi Electric disclosed multiple denial-of-service vulnerabilities affecting MELSEC iQ-R industrial controllers and related modules used in the critical manufacturing sector. The issues include improper input validation in CVE-2022-40265, improper session management in CVE-2021-20591, and uncontrolled resource consumption flaws tracked as CVE-2020-5666 and CVE-2020-5527. The vulnerabilities can be exploited remotely in various configurations to disrupt communications, block legitimate client connections, or force affected devices into an unresponsive state that may require a system reset or port recovery.
Affected products span MELSEC iQ-R CPU modules, Ethernet interfaces, C Controller modules, and broader MELSEC controller families including iQ-F, Q, L, and F series in some cases. Mitsubishi Electric issued firmware updates and mitigations such as disabling unnecessary web server functions, upgrading to fixed firmware, restricting network access with firewalls and IP filtering, and limiting exposure to trusted LAN environments or VPN-protected remote access. CISA also urged operators to isolate control systems from business networks and reduce Internet exposure; at the time of the advisories, no known public exploits were reported as specifically targeting these flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CISA published an advisory for CVE-2022-40265, an improper input validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series products that could be exploited remotely without authentication to cause a denial-of-service condition requiring a system reset. Mitsubishi Electric released fixes in firmware version 66 or later and recommended network access restrictions and filtering.
CISA published Update B for its Mitsubishi Electric MELSEC iQ-R Series C Controller Module advisory. The provided reference does not include technical synopsis details, but it indicates a distinct advisory update event.
CISA issued an advisory for CVE-2021-20591, an uncontrolled resource consumption issue in Mitsubishi Electric MELSEC iQ-R Series CPU modules caused by improper session management. The flaw could prevent legitimate clients from connecting, and Mitsubishi Electric recommended network restrictions, IP filtering, and recovery steps.
Mitsubishi Electric disclosed CVE-2020-5666, an uncontrolled resource consumption vulnerability in MELSEC iQ-R series CPU modules that could be exploited remotely to cause a denial-of-service condition when the CPU module web server is enabled. Fixed firmware versions were released, and researcher Xiaofei.Zhang was credited with reporting the issue.
CISA published an advisory for CVE-2020-5527, an uncontrolled resource consumption vulnerability affecting Mitsubishi Electric MELSEC programmable controllers using the MELSOFT transmission port over UDP/IP. The issue could be exploited remotely to disrupt communications or make devices unresponsive across MELSEC iQ-R, iQ-F, Q, L, and F series products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourceus-cert.cisa.gov
Open sourceus-cert.cisa.gov
Open sourceus-cert.cisa.gov
Open sourceus-cert.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued multiple ICS advisories covering **Mitsubishi Electric MELSEC** controllers used in critical manufacturing, warning that several product lines are exposed to remotely exploitable flaws. The most severe issues affect **MELSEC-Q/L Series** factory automation controllers, where five vulnerabilities—`CVE-2024-0802`, `CVE-2024-0803`, `CVE-2024-1915`, `CVE-2024-1916`, and `CVE-2024-1917`—carry **CVSS 9.8** ratings and could let an attacker read arbitrary information or execute malicious code by sending crafted packets. Mitsubishi released remediated versions tied to newer serial-number ranges, and CISA said no public exploitation had been reported at publication. Separate advisories also warned that **MELSEC iQ-R Series Safety CPU and SIL2 Process CPU** modules contain flaws that can expose usernames through brute-force attempts (`CVE-2021-20594`), leak credentials via network sniffing (`CVE-2021-20597`), and lock out legitimate users after repeated failed logins (`CVE-2021-20598`). In addition, **MELSEC iQ-R, Q, and L Series** CPU modules are affected by an uncontrolled resource consumption bug, `CVE-2020-5652`, that can trigger a denial of service on the Ethernet port until the device is reset. Mitsubishi has provided firmware fixes for many affected systems, while CISA urged operators to isolate control networks, use firewalls or VPNs, block untrusted access, and apply compensating controls for legacy devices that cannot be updated.
Jun 29, 2026
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026
CISA issued multiple advisories covering vulnerabilities in Mitsubishi Electric industrial control system products, including **MELFA SD/SQ and F-series robot controllers**, **MELSEC iQ-F**, **iQ-R**, **Q**, **L series**, and **MELIPC** platforms. The most severe issues included remotely exploitable authentication weaknesses in factory automation devices and an authentication bypass in robot controllers caused by active debug code, tracked as `CVE-2022-33323`, which could permit unauthorized telnet access. Other flaws, including `CVE-2022-25155` through `CVE-2022-25160`, involved weak or improper authentication handling, cleartext storage of sensitive information, and capture-replay abuse that could let unauthenticated attackers log in, disclose data, tamper with product information, or impersonate legitimate users. A separate advisory also warned that multiple Intel third-party component vulnerabilities affected Mitsubishi Electric factory automation products, creating risks including privilege escalation, parameter disclosure, and denial of service, with a worst-case **CVSS v3 8.8**. Mitsubishi Electric released firmware updates or mitigation guidance and directed customers to vendor bulletins and Intel advisories where applicable. CISA urged operators to limit network exposure, isolate control systems from business networks, use firewalls or VPNs for remote access, restrict physical access where relevant, and follow standard ICS hardening practices. The advisories said no known public exploits were specifically targeting these vulnerabilities at the time of publication.
Jun 29, 2026