CVE-2024-1916
published 2024-03-15CVE-2024-1916: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.07%
60.5th percentile
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| mitsubishi_electric_corporation | melsec-l_series_l02cpu | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l02cpu-p | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l06cpu | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l06cpu-p | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l26cpu | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l26cpu-bt | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l26cpu-p | — | — |
| mitsubishi_electric_corporation | melsec-l_series_l26cpu-pbt | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q03udecpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q03udvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q04udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q04udpvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q04udvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q06udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q06udpvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q06udvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q100udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q10udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q13udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q13udpvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q13udvcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q20udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q26udehcpu | — | — |
| mitsubishi_electric_corporation | melsec-q_series_q26udpvcpu | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: remote unauthenticated attacker sends a specially crafted packet to MELSEC-Q/L Series CPU modules to exploit Integer Overflow or Wraparound (CWE-190), potentially achieving remote code execution ↗
- →Network-facing attack with no authentication required (AV:N/AC:L/PR:N/UI:N); monitor for unexpected or malformed inbound packets to MELSEC-Q/L Series CPU modules on the OT network ↗
- →Affected serial numbers for MELSEC-Q Series: first 5 digits of serial No. '26061' and prior; flag devices with these serial numbers communicating over untrusted networks ↗
- →Affected serial numbers for MELSEC-L Series: first 5 digits of serial No. '26041' and prior; flag devices with these serial numbers communicating over untrusted networks ↗
- ·No known public exploitation specifically targeting this vulnerability has been reported at time of advisory publication ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-1916
vendor_chrome·2025-03-18·CVSS 8.8
CVE-2025-1916 [MEDIUM] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-1916
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2025-1916: Use after free in Profiles. Reported by parkminchan, SSD Labs Korea on 2024-10-31 [$55000
Severity: medium
CISA ICS
Mitsubishi Electric MELSEC-Q/L Series (Update B)
cisa_ics·2024-06-13
Mitsubishi Electric MELSEC-Q/L Series (Update B)
ICS Advisory
##
Mitsubishi Electric MELSEC-Q/L Series (Update B)
Last RevisedJune 13, 2024
Alert CodeICSA-24-074-14
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Mitsubishi Electric
- Equipment: MELSEC-Q/L Series
- Vulnerabilities: Incorrect Pointer Scaling, Integer Overflow or Wraparound
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow a remote attacker to be able to read arbitrary information or execute malicious code on a target product by sending a specially crafted packet.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Mitsubishi Ele
GHSA
GHSA-wvp9-cm8c-37mr: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauth
ghsa_unreviewed·2024-03-15
CVE-2024-1916 [CRITICAL] CWE-190 GHSA-wvp9-cm8c-37mr: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauth
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://jvn.jp/vu/JVNVU99690199/https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdfhttps://jvn.jp/vu/JVNVU99690199/https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
2024-03-15
Published