Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote…

published 2024-03-15 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-17637

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

Patch / fix

fixed in 24

mitsubishielectric melsec_q-q03udecpu xxxxx26061
mitsubishielectric melsec_q-q04udehcpu xxxxx26061
mitsubishielectric melsec_q-q06udehcpu xxxxx26061
mitsubishielectric melsec_q-q10udehcpu xxxxx26061
mitsubishielectric melsec_q-q13udehcpu xxxxx26061
mitsubishielectric melsec_q-q20udehcpu xxxxx26061
mitsubishielectric melsec_q-q26udehcpu xxxxx26061
mitsubishielectric melsec_q-q50udehcpu xxxxx26061
mitsubishielectric melsec_q-q100udehcpu xxxxx26061
mitsubishi melsec_q03udvcpu xxxxx26061
mitsubishi melsec_q04udvcpu xxxxx26061
mitsubishi melsec_q06udvcpu xxxxx26061
mitsubishi melsec_q13udvcpu xxxxx26061
mitsubishi melsec_q26udvcpu xxxxx26061
mitsubishi melsec_q06udpvcpu xxxxx26061
mitsubishi melsec_q13udpvcpu xxxxx26061
mitsubishi melsec_q26udpvcpu xxxxx26061
mitsubishielectric l02cpu-p xxxxx26041
mitsubishi melsec_l06cpu\(-p\) xxxxx26041
mitsubishi melsec_l26cpu\(-p\) xxxxx26041
mitsubishielectric melsec_l02cpu-p xxxxx26041
mitsubishielectric melsec_l06cpu-p xxxxx26041
mitsubishielectric melsec_l26cpu-p xxxxx26041
mitsubishielectric l26cpu-bt xxxxx26041

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-074-14 updated 2024-06-13 cvss 9.8

Mitsubishi Electric MELSEC-Q/L Series (Update B)

Mitsubishi Electric MELSEC-L Series L02CPU(-P) <=The_first_5_digits_of_serial_No._"26041" Mitsubishi Electric MELSEC-L Series L06CPU(-P) <=The_first_5_digits_of_serial_No._"26041" Mitsubishi Electric MELSEC-L Series L26CPU-(P)BT <=The_first_5_digits_of_serial_No._"26041" Mitsubishi Electric MELSEC-L Series L26CPU(-P) <=The_first_5_digits_of_serial_No._"26041"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q03UDECPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q03UDVCPU <=The_first_5_digits_of_serial_No._"26061"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q04UDEHCPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q04UDPVCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q04UDVCPU <=The_first_5_digits_of_serial_No._"26061"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q06UDEHCPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q06UDPVCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q06UDVCPU <=The_first_5_digits_of_serial_No._"26061"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q10UDEHCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q13UDEHCPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com

show 4 more

Mitsubishi Electric MELSEC-Q Series Q13UDPVCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q13UDVCPU <=The_first_5_digits_of_serial_No._"26061"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q20UDEHCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q26UDEHCPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q26UDPVCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q26UDVCPU <=The_first_5_digits_of_serial_No._"26061"
affected: mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com
Mitsubishi Electric MELSEC-Q Series Q50UDEHCPU <=The_first_5_digits_of_serial_No._"26061" Mitsubishi Electric MELSEC-Q Series Q100UDEHCPU <=The_first_5_digits_of_serial_No._"26061"
affected: vendor fix, mitigation “Mitsubishi Electric released the fixed version of the product:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-03-15)

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU
Mitsubishi Electric Corporation MELSEC-Q Series Q04UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q06UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q10UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q13UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q20UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q26UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q50UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q100UDEHCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q04UDVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q06UDVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q13UDVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q26UDVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q04UDPVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q06UDPVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q13UDPVCPU
Mitsubishi Electric Corporation MELSEC-Q Series Q26UDPVCPU
Mitsubishi Electric Corporation MELSEC-L Series L02CPU
Mitsubishi Electric Corporation MELSEC-L Series L06CPU
Mitsubishi Electric Corporation MELSEC-L Series L26CPU
Mitsubishi Electric Corporation MELSEC-L Series L02CPU-P
Mitsubishi Electric Corporation MELSEC-L Series L06CPU-P
Mitsubishi Electric Corporation MELSEC-L Series L26CPU-P
Mitsubishi Electric Corporation MELSEC-L Series L26CPU-BT
Mitsubishi Electric Corporation MELSEC-L Series L26CPU-PBT
mitsubishielectric melsec_q-q03udecpu
mitsubishielectric melsec_q-q04udehcpu
mitsubishielectric melsec_q-q06udehcpu
mitsubishielectric melsec_q-q10udehcpu
mitsubishielectric melsec_q-q13udehcpu
mitsubishielectric melsec_q-q20udehcpu
mitsubishielectric melsec_q-q26udehcpu
mitsubishielectric melsec_q-q50udehcpu
mitsubishielectric melsec_q-q100udehcpu
mitsubishi melsec_q03udvcpu
mitsubishi melsec_q04udvcpu
mitsubishi melsec_q06udvcpu
mitsubishi melsec_q13udvcpu
mitsubishi melsec_q26udvcpu
mitsubishi melsec_q06udpvcpu
mitsubishi melsec_q13udpvcpu
mitsubishi melsec_q26udpvcpu
mitsubishielectric l02cpu-p
mitsubishi melsec_l06cpu\(-p\)
mitsubishi melsec_l26cpu\(-p\)
mitsubishielectric melsec_l02cpu-p
mitsubishielectric melsec_l06cpu-p
mitsubishielectric melsec_l26cpu-p
mitsubishielectric l26cpu-bt

Classification

Weakness

CWE-468 Incorrect Pointer Scaling

References

mitsubishielectric.com /en/psirt/vulnerability/pdf/2023-024_en.pdf
vendor-advisory
jvn.jp /vu/JVNVU99690199/
government-resource
cisa.gov /news-events/ics-advisories/icsa-24-074-14
government-resource

Sources

CVE List CVE-2024-1915
NVD CVE-2024-1915

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary