CISA warns of Mitsubishi Electric flaw that can disrupt industrial communications

What happened

CISA republished Mitsubishi Electric’s advisory on a vulnerability in multiple FA products that it identified as CVE-2025-3511. The agency said the issue affects the Ethernet function in a range of industrial automation devices and can be triggered remotely with a specially crafted UDP packet.

The advisory says successful exploitation could cause a denial-of-service condition, a communication delay or a timeout error, depending on the product. In the cases described, recovery requires a system reset, except for one timeout scenario in FX5 Ethernet and FX5-ENET/IP products, where communication resumes after valid UDP packets are received again.

Why it matters

The flaw affects products used in critical manufacturing and is rated HIGH with a CVSS v3.1 base score of 7.5. Because the attack can be launched over a network and does not require privileges or user interaction, organizations that run the affected equipment may face service disruption if systems are exposed to untrusted traffic.

Context and background

CISA said the notice is a verbatim republication of Mitsubishi Electric’s advisory 2025-001, issued under the title “Mitsubishi Electric Multiple FA Products (Update D).” The vulnerability is described as Improper Validation of Specified Quantity in Input, or CWE-1284.

The agency said Mitsubishi Electric discovered the issue. The advisory lists worldwide deployment and says the company headquarters is in Japan.

CISA’s page names many affected product families and version ranges, including CC-Link IE TSN remote I/O modules, analog-to-digital and digital-to-analog converter modules, FPGA modules, remote station communication LSIs with GbE-PHY, MELSEC iQ-R master/local modules, an Ethernet interface module, CP610 LSIs, MELSEC iQ-F modules and iQ-R CPU network parts.

What the companies said

According to the advisory, Mitsubishi Electric is releasing fixed versions for the affected products. The update list includes version 10 or later for the listed remote I/O modules, 08 or later for the listed converter modules, 02 or later for the FPGA modules, 1.09K or later for the CP620 with GbE-PHY modules, and version-specific fixes for the remaining affected product families.

Mitsubishi Electric also recommended using a firewall or VPN when internet access is required, keeping the products within a LAN, blocking untrusted networks and hosts, restricting physical access and installing antivirus software on PCs that can access the affected products.

What happens next

Users are directed to Mitsubishi Electric’s download page and the vendor security advisory PDF for product-specific fix information. CISA’s advisory page also includes a revision history, with entries running through 2026-08-27.

Sources

• CISA advisory: ICSA-25-128-03

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.