Mitsubishi Electric MELSEC-Q/L Series (Update B)

Risk Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to be able to read arbitrary information or execute malicious code on a target product by sending a specially crafted packet.

CVEs (5)

Remediations

• Mitsubishi Electric released the fixed version of the product:
• MELSEC-Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: firmware versions where the first 5 digits of serial No. "26062" or later
• MELSEC-Q Series Q03/04/06/13/26UDVCPU: firmware versions where the first 5 digits of serial No. "26062" or later
• MELSEC-Q Series Q04/06/13/26UDPVCPU: firmware versions where the first 5 digits of serial No. "26062" or later
• MELSEC-L Series L02/06/26CPU(-P), L26CPU-(P)BT: firmware versions where the first 5 digits of serial No. "26042" or later
• Mitsubishi Electric recommends that users consider replacing with MELSEC iQ-R Series.
• Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities:
• Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Restrict physical access to the affected product as well as to the personal computers and the network devices that can communicate with it.
• Install antivirus software on your personal computer that can access the affected product.
• For specific additional details, see Mitsubishi Electric advisory 2023-024.

Affected Vendors

Affected Products (22)

Affected Sectors

Critical Manufacturing