Vulnerability details
CVE-2025-15080
Mitsubishi Electric MELSEC iQ-R Series R08PCPUMitsubishi Electric MELSEC iQ-R Series R120PCPUMitsubishi Electric MELSEC iQ-R Series R16PCPUMitsubishi Electric MELSEC iQ-R Series R32PCPU
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products
CVSS 4.0
8.8High
Official description
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 4.0 | CVEProject cvelistV5 (CNA) (Mitsubishi) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Mitsubishi Electric Corporation | MELSEC iQ-R Series R08PCPU | Firmware versions "48" and prior | CVEProject cvelistV5 (CNA) |
| Mitsubishi Electric Corporation | MELSEC iQ-R Series R120PCPU | Firmware versions "48" and prior | CVEProject cvelistV5 (CNA) |
| Mitsubishi Electric Corporation | MELSEC iQ-R Series R16PCPU | Firmware versions "48" and prior | CVEProject cvelistV5 (CNA) |
| Mitsubishi Electric Corporation | MELSEC iQ-R Series R32PCPU | Firmware versions "48" and prior | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://jvn.jp/vu/JVNVU95093080/ government-resource
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-020_en.pdf vendor-advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-036-02 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-05
- Last updated
- 2026-02-06
- State
- Published
- Assigner (CNA)
- Mitsubishi
Exploit prediction (EPSS)
0.59%
Probability of exploitation in 30 days
48.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1284Improper Validation of Specified Quantity in Input