A newly disclosed vulnerability affects several versions of **Mitsubishi Electric** CNC Series, potentially leading to denial-of-service (DoS) conditions. The vulnerability, tracked as **CVE-2025-2399**, arises from improper validation of specified index, position, or offset in input. ### Vulnerability Details The **Cybersecurity and Infrastructure Security Agency (CISA)** has published an advisory detailing the vulnerability. Successful exploitation could allow a remote attacker to trigger an out-of-bounds read by sending specially crafted packets to TCP port 683. Specifically, the vulnerability is classified as CWE-1285, Improper Validation of Specified Index, Position, or Offset in Input. ### Affected Products The following versions of Mitsubishi Electric CNC Series are affected: * M800VW (BND-2051W000) <=BB * M800VS (BND-2052W000) <=BB * M80V (BND-2053W000) <=BB * M80VW (BND-2054W000) <=BB * M800W (BND-2005W000) <=FM * M800S (BND-2006W000) <=FM * M80 (BND-2007W000) <=FM * M80W (BND-2008W000) <=FM * E80 (BND-2009W000) <=FM * C80 (BND-2036W000) vers:all/* * M750VW (BND-1015W002) vers:all/* * M730VW (BND-1015W000) vers:all/* * M720VW (BND-1015W000) vers:all/* * M750VS (BND-1012W002) vers:all/* * M730VS (BND-1012W000-**) vers:all/* * M720VS (BND-1012W000) vers:all/* * M70V (BND-1018W000) vers:all/* * E70 (BND-1022W000) vers:all/* * NC Trainer2 (BND-1802W000) vers:all/* * NC Trainer2 plus (BND-1803W000) vers:all/* ### Impact Successful exploitation of this vulnerability could lead to a denial-of-service condition, disrupting operations relying on the affected CNC systems. ### Mitigation **CISA** recommends the following mitigation strategies: * Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the internet. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods such as VPNs, ensuring the VPNs are updated to the most recent version. * Perform proper impact analysis and risk assessment prior to deploying defensive measures. ### Additional Resources Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA. [View CSAF](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-05.json)