vulnwire
9.8crit

CVE-2024-0803

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a re…

Published 2 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

1.04% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q04UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q06UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q10UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q13UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q20UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q26UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q50UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q100UDEHCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q04UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q06UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q13UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q26UDVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q04UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q06UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q13UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-Q Series Q26UDPVCPU
  • Mitsubishi Electric Corporation MELSEC-L Series L02CPU
  • Mitsubishi Electric Corporation MELSEC-L Series L06CPU
  • Mitsubishi Electric Corporation MELSEC-L Series L26CPU
  • Mitsubishi Electric Corporation MELSEC-L Series L02CPU-P
  • Mitsubishi Electric Corporation MELSEC-L Series L06CPU-P
  • Mitsubishi Electric Corporation MELSEC-L Series L26CPU-P
  • Mitsubishi Electric Corporation MELSEC-L Series L26CPU-BT
  • Mitsubishi Electric Corporation MELSEC-L Series L26CPU-PBT
  • mitsubishielectric melsec_q-q03udecpu
  • mitsubishielectric melsec_q-q04udehcpu
  • mitsubishielectric melsec_q-q06udehcpu
  • mitsubishielectric melsec_q-q10udehcpu
  • mitsubishielectric melsec_q-q13udehcpu
  • mitsubishielectric melsec_q-q20udehcpu
  • mitsubishielectric melsec_q-q26udehcpu
  • mitsubishielectric melsec_q-q50udehcpu
  • mitsubishielectric melsec_q-q100udehcpu
  • mitsubishi melsec_q03udvcpu
  • mitsubishi melsec_q04udvcpu
  • mitsubishi melsec_q06udvcpu
  • mitsubishi melsec_q13udvcpu
  • mitsubishi melsec_q26udvcpu
  • mitsubishi melsec_q06udpvcpu
  • mitsubishi melsec_q13udpvcpu
  • mitsubishi melsec_q26udpvcpu
  • mitsubishielectric l02cpu-p
  • mitsubishi melsec_l06cpu\(-p\)
  • mitsubishi melsec_l26cpu\(-p\)
  • mitsubishielectric melsec_l02cpu-p
  • mitsubishielectric melsec_l06cpu-p
  • mitsubishielectric melsec_l26cpu-p
  • mitsubishielectric l26cpu-bt

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

  • mitsubishielectric.com /en/psirt/vulnerability/pdf/2023-024_en.pdf · vendor-advisory, x_transferred
  • jvn.jp /vu/JVNVU99690199/ · government-resource, x_transferred
  • cisa.gov /news-events/ics-advisories/icsa-24-074-14 · government-resource, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.