cbcvebase.
CVE-2024-0802
published 2024-03-15

CVE-2024-0802: Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated…

PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.07%
60.5th percentile
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
mitsubishi_electric_corporationmelsec-l_series_l02cpu——
mitsubishi_electric_corporationmelsec-l_series_l02cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l06cpu——
mitsubishi_electric_corporationmelsec-l_series_l06cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-bt——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-pbt——
mitsubishi_electric_corporationmelsec-q_series_q03udecpu——
mitsubishi_electric_corporationmelsec-q_series_q03udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q100udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q10udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q20udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udvcpu——

Detection & IOCsextracted from sources · hover to see the quote

  • →Detect specially crafted packets targeting Mitsubishi Electric MELSEC-Q/L Series CPU modules over the network; exploitation is unauthenticated and requires no user interaction (AV:N/AC:L/PR:N/UI:N) ↗
  • →Block or alert on inbound network traffic to MELSEC-Q/L Series PLCs from untrusted hosts; the attack vector is network-based with low complexity and no authentication required ↗
  • →No known public exploitation has been reported; monitor for anomalous packet activity targeting MELSEC-Q/L Series devices as a proactive measure ↗
  • ·Affected MELSEC-Q Series devices are those with the first 5 digits of serial No. '26061' and prior; fixed versions have serial No. '26062' or later ↗
  • ·Affected MELSEC-L Series devices are those with the first 5 digits of serial No. '26041' and prior; fixed versions have serial No. '26042' or later ↗
  • ·CVE-2024-0802 (Incorrect Pointer Scaling, CVSS 9.8) is one of five related vulnerabilities (CVE-2024-0802, -0803, -1915, -1916, -1917) affecting the same product line via the same attack vector ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.