cbcvebase.
CVE-2024-1917
published 2024-03-15

CVE-2024-1917: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.07%
60.5th percentile
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
googlechrome_chrome——
mitsubishi_electric_corporationmelsec-l_series_l02cpu——
mitsubishi_electric_corporationmelsec-l_series_l02cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l06cpu——
mitsubishi_electric_corporationmelsec-l_series_l06cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-bt——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-p——
mitsubishi_electric_corporationmelsec-l_series_l26cpu-pbt——
mitsubishi_electric_corporationmelsec-q_series_q03udecpu——
mitsubishi_electric_corporationmelsec-q_series_q03udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q04udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q06udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q100udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q10udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udpvcpu——
mitsubishi_electric_corporationmelsec-q_series_q13udvcpu——
mitsubishi_electric_corporationmelsec-q_series_q20udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udehcpu——
mitsubishi_electric_corporationmelsec-q_series_q26udpvcpu——

Detection & IOCsextracted from sources · hover to see the quote

  • →Trigger condition: remote unauthenticated attacker sends a specially crafted packet to MELSEC-Q/L Series CPU modules to exploit integer overflow (CWE-190) and achieve remote code execution ↗
  • →Network vector, no authentication required, low complexity — monitor for anomalous/malformed packets targeting MELSEC-Q/L Series CPU modules from untrusted or external hosts ↗
  • →Affected serial numbers for MELSEC-Q Series: first 5 digits '26061' and prior; for MELSEC-L Series: first 5 digits '26041' and prior — use asset inventory to identify vulnerable devices on the network ↗
  • →Block or alert on inbound network connections to MELSEC-Q/L Series PLCs from untrusted networks; these devices should not be internet-facing ↗
  • ·No known public exploitation has been reported at time of advisory publication; no exploit code, hashes, IPs, domains, or specific packet signatures are publicly documented for CVE-2024-1917 ↗
  • ·CVE-2024-1917 is one of five related CVEs (CVE-2024-0802, CVE-2024-0803, CVE-2024-1915, CVE-2024-1916, CVE-2024-1917) affecting the same product line via the same attack vector (specially crafted packet); detections should cover all five ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.