Home / Items
Industrial control advisorySeverity 5.9 medium
Mitsubishi Electric CNC Series (Update A)
ICSA-26-078-05 · CISA · March 10, 2026
Summary
Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.
From CISA, quoted as published. Check the source before acting.
What to do
Please apply the fixed version (BC or later) for Mitsubishi Electric M800VW (BND-2051W000), M800VS (BND-2052W000), M80V (BND-2053W000), and M80VW (BND-2054W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative.
Please apply the fixed version (FN or later) for Mitsubishi Electric M800W (BND-2005W000), M800S (BND-2006W000), M80 (BND-2007W000), M80W (BND-2008W000), and E80 (BND-2009W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative.
Please apply the fixed version (LK or later) for Mitsubishi Electric M750VW (BND-1015W002), M730VW (BND-1015W000), M720VW (BND-1015W000), M750VS (BND-1012W002), M730VS (BND-1012W000), M720VS (BND-1012W000), M70V (BND-1018W000), and E70 (BND-1022W000). For instructions on how to apply it, please consult your Mitsubishi Electric representative.
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall or virtual private network (VPN) to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability.
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the product within a LAN and blocking access from untrusted networks and hosts through a firewall, to minimize the risk of exploiting this vulnerability.
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using IP filters to prevent unauthorized access, when internet access is required, to minimize the risk of exploiting this vulnerability. IP filter function is available for M800V/M80V Series and M800/M80/E80 Series. For details about the IP filter function, refer to the following manual for each product which can be downloaded from the link "https://www.mitsubishielectric.com/fa/download/index.html ": M800V/M80V Series Instruction Manual "16. Appendix 3 IP Address Filter Setting Function", M800/M80/E80 Series Instruction Manual "15. Appendix 2 IP Address Filter Setting Function".
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product and to all computers and network devices to which the products are connected, to minimize the risk of exploiting this vulnerability.
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2025-2399 | 5.9 medium | No | 0.6% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Mitsubishi Electric | Mitsubishi Electric M800VW (BND-2051W000) |
| Mitsubishi Electric | Mitsubishi Electric M800VS (BND-2052W000) |
| Mitsubishi Electric | Mitsubishi Electric M80V (BND-2053W000) |
| Mitsubishi Electric | Mitsubishi Electric M80VW (BND-2054W000) |
| Mitsubishi Electric | Mitsubishi Electric M800W (BND-2005W000) |
| Mitsubishi Electric | Mitsubishi Electric M800S (BND-2006W000) |
| Mitsubishi Electric | Mitsubishi Electric M80 (BND-2007W000) |
| Mitsubishi Electric | Mitsubishi Electric M80W (BND-2008W000) |
| Mitsubishi Electric | Mitsubishi Electric E80 (BND-2009W000) |
| Mitsubishi Electric | Mitsubishi Electric C80 (BND-2036W000) |
| Mitsubishi Electric | Mitsubishi Electric M750VW (BND-1015W002) |
| Mitsubishi Electric | Mitsubishi Electric M730VW (BND-1015W000) |
| Mitsubishi Electric | Mitsubishi Electric M720VW (BND-1015W000) |
| Mitsubishi Electric | Mitsubishi Electric M750VS (BND-1012W002) |
| Mitsubishi Electric | Mitsubishi Electric M730VS (BND-1012W000) |
| Mitsubishi Electric | Mitsubishi Electric M720VS (BND-1012W000) |
| Mitsubishi Electric | Mitsubishi Electric M70V (BND-1018W000) |
| Mitsubishi Electric | Mitsubishi Electric E70 (BND-1022W000) |
Why it's on these mode pages
- Maritime: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- March 10, 2026: Initial Publication
- March 19, 2026: CISA Republication - Initial CISA Republication of Mitsubishi Electric V20250121-001#02 advisory
- August 27, 2026: Removed Software Tools NC Trainer2 and Software Tools NC Trainer2 plus, from affected products. And added M700V/M70V/E70 Series as fixed products.
- August 27, 2026: CISA Republication update based on Mitsubishi Electric 2025-022 advisory
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com