CISA republishes Mitsubishi Electric CNC advisory on CVE-2025-2399

CISA republished Mitsubishi Electric’s advisory for its CNC Series (Update A) on Aug. 27, 2026, after the vendor identified CVE-2025-2399, a medium-severity vulnerability that could let a remote attacker trigger an out-of-bounds read and cause a denial-of-service condition.

CISA said specially crafted packets sent to TCP port 683 can trigger the issue, and that the flaw is listed as CVSS v3.1 base score 5.9 with a medium severity rating.

The advisory maps the bug to CWE-1285, described as improper validation of a specified index, position or offset in input. CISA said the issue affects Mitsubishi Electric CNC Series products marked known affected.

Among the affected products are M800VW, M800VS, M80V and M80VW with versions up to BB; M800W, M800S, M80, M80W and E80 up to FM; C80 listed as vers:all/*; and M750VW, M730VW, M720VW, M750VS, M730VS, M720VS, M70V and E70 up to LJ. CISA also said the affected products are deployed worldwide and that Mitsubishi Electric is headquartered in Japan.

Mitsubishi Electric recommends fixed versions for several product lines. The advisory says BC or later is the fix for M800VW, M800VS, M80V and M80VW. FN or later is recommended for M800W, M800S, M80, M80W and E80. LK or later is recommended for M750VW, M730VW, M720VW, M750VS, M730VS, M720VS, M70V and E70.

For products without a fixed version, or when updates cannot be applied right away, Mitsubishi Electric recommends using a firewall or VPN when internet access is required, keeping the product within a LAN, blocking access from untrusted networks and hosts, using IP filters where available, restricting physical access to affected products and connected devices, and installing antivirus software on PCs that can access the product.

CISA’s revision history says the advisory was first published on March 10, 2026, republished on March 19, 2026, and updated again on Aug. 27, 2026. The Aug. 27 update removed Software Tools NC Trainer2 and Software Tools NC Trainer2 plus from affected products and added M700V, M70V and E70 Series as fixed products.

CISA said Mitsubishi Electric reported the vulnerability to the agency.

Sources

• CISA Cybersecurity Advisories: ICSA-26-078-05

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.