cbcvebase.
CVE-2024-0803
published 2024-03-15

CVE-2024-0803: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.04%
59.8th percentile
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
mitsubishi_electric_corporationmelsec-l_series_l02cpu——
mitsubishi_electric_corporationmelsec-l_series_l02cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l06cpu——
mitsubishi_electric_corporationmelsec-l_series_l06cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-bt——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-pbt——
mitsubishi_electric_corporationmelsec-q_series_q03udecpu——
mitsubishi_electric_corporationmelsec-q_series_q03udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q100udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q10udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q20udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udvcpu——

Detection & IOCsextracted from sources · hover to see the quote

  • →Trigger condition is a specially crafted packet sent remotely over the network to MELSEC-Q/L Series CPU modules — monitor for anomalous/malformed packets targeting these PLCs on the network ↗
  • →Exploitation requires no authentication and no user interaction (CVSS AV:N/AC:L/PR:N/UI:N) — any unauthenticated network connection to the PLC should be treated as suspicious ↗
  • →Block and alert on inbound connections to MELSEC-Q/L Series CPUs from untrusted hosts; these devices should only be reachable within a controlled LAN ↗
  • ·Affected scope is limited to MELSEC-Q Series CPUs with serial number first-5-digits '26061' and prior, and MELSEC-L Series CPUs with first-5-digits '26041' and prior; fixed firmware starts at '26062' (Q Series) and '26042' (L Series) ↗
  • ·No known public exploitation has been reported at time of advisory publication — detections should be tuned to reduce false positives in environments where these PLCs are legitimately network-accessible ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.