Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Industrial control advisorySeverity 5.9 medium

Mitsubishi Electric CNC Series (Update A)

ICSA-26-078-05 · CISA · March 10, 2026

Summary

Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.

From CISA, quoted as published. Check the source before acting.

What to do

Please apply the fixed version (BC or later) for Mitsubishi Electric M800VW (BND-2051W000), M800VS (BND-2052W000), M80V (BND-2053W000), and M80VW (BND-2054W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative. Please apply the fixed version (FN or later) for Mitsubishi Electric M800W (BND-2005W000), M800S (BND-2006W000), M80 (BND-2007W000), M80W (BND-2008W000), and E80 (BND-2009W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative. Please apply the fixed version (LK or later) for Mitsubishi Electric M750VW (BND-1015W002), M730VW (BND-1015W000), M720VW (BND-1015W000), M750VS (BND-1012W002), M730VS (BND-1012W000), M720VS (BND-1012W000), M70V (BND-1018W000), and E70 (BND-1022W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative. For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall or virtual private network (VPN) to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability. For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the product within a LAN and blocking access from untrusted networks and hosts through a firewall, to minimize the risk of exploiting this vulnerability. For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using IP filters to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability. IP filter function is available for M800V/M80V Series and M800/M80/E80 Series. For details about the IP filter function, refer to the following manual for each product which can be downloaded from the link "https://www.mitsubishielectric.com/fa/download/index.html ": M800V/M80V Series Instruction Manual "16. Appendix 3 IP Address Filter Setting Function", M800/M80/E80 Series Instruction Manual "15. Appendix 2 IP Address Filter Setting Function". For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product and to all computers and network devices to which the products are connected, to minimize the risk of exploiting this vulnerability. For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2025-23995.9 mediumNo0.6%Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
Mitsubishi ElectricMitsubishi Electric M800VW (BND-2051W000)<=BB—
Mitsubishi ElectricMitsubishi Electric M800VS (BND-2052W000)<=BB—
Mitsubishi ElectricMitsubishi Electric M80V (BND-2053W000)<=BB—
Mitsubishi ElectricMitsubishi Electric M80VW (BND-2054W000)<=BB—
Mitsubishi ElectricMitsubishi Electric M800W (BND-2005W000)<=FM—
Mitsubishi ElectricMitsubishi Electric M800S (BND-2006W000)<=FM—
Mitsubishi ElectricMitsubishi Electric M80 (BND-2007W000)<=FM—
Mitsubishi ElectricMitsubishi Electric M80W (BND-2008W000)<=FM—
Mitsubishi ElectricMitsubishi Electric E80 (BND-2009W000)<=FM—
Mitsubishi ElectricMitsubishi Electric C80 (BND-2036W000)vers:all/*—
Mitsubishi ElectricMitsubishi Electric M750VW (BND-1015W002)<=LJ—
Mitsubishi ElectricMitsubishi Electric M730VW (BND-1015W000)<=LJ—
Mitsubishi ElectricMitsubishi Electric M720VW (BND-1015W000)<=LJ—
Mitsubishi ElectricMitsubishi Electric M750VS (BND-1012W002)<=LJ—
Mitsubishi ElectricMitsubishi Electric M730VS (BND-1012W000)<=LJ—
Mitsubishi ElectricMitsubishi Electric M720VS (BND-1012W000)<=LJ—
Mitsubishi ElectricMitsubishi Electric M70V (BND-1018W000)<=LJ—
Mitsubishi ElectricMitsubishi Electric E70 (BND-1022W000)<=LJ—

Why it's on these mode pages

  • Maritime: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. March 10, 2026: Initial Publication
  2. March 19, 2026: CISA Republication - Initial CISA Republication of Mitsubishi Electric V20250121-001#02 advisory
  3. August 27, 2026: Removed Software Tools NC Trainer2 and Software Tools NC Trainer2 plus, from affected products. And added M700V/M70V/E70 Series as fixed products.
  4. August 27, 2026: CISA Republication update based on Mitsubishi Electric 2025-022 advisory
  5. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com