CVE-2025-8531 - CVE House
Back to Database
Status published Medium CVE-2025-8531

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric...

Vulnerability Description

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8531

Credits & Attribution

No credits recorded in the NVD database.

References

More from Mitsubishi Electric Corporation

View All →
CVE-2025-7731
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
High 7.5
CVE-2025-7405
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
High 7.3
CVE-2025-7376
Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS
Medium 5.9
CVE-2025-5514
Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module
Medium 5.3
CVE-2025-5241
Denial-of-Service Vulnerability in MELSEC iQ-F Series
Medium 5.3

Affected Vendor

Mitsubishi Electric Corporation

View all reports →

Affected Software

MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q13UDPVCPU, MELSEC-Q Series Q26UDPVCPU
Vulnerable Versions:
The first 5 digits of serial No. "24082" to "27081"

Timeline

Official Publish: September 19th, 2025
Last Modified: September 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-130

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.