What’s Vulnerable › Vulnerabilities
CVE-2019-6535: Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-02-05 · updated 2026-06-17
- Weakness: CWE-400
Description
Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication.
Affected products
- Mitsubishielectric Q03Udecpu Firmware: through 20101
- Mitsubishielectric Q03Udvcpu Firmware: through 20081
- Mitsubishielectric Q04Udehcpu Firmware: through 20101
- Mitsubishielectric Q04Udpvcpu Firmware: through 20081
- Mitsubishielectric Q04Udvcpu Firmware: through 20081
- Mitsubishielectric Q06Udehcpu Firmware: through 20101
- Mitsubishielectric Q06Udpvcpu Firmware: through 20081
- Mitsubishielectric Q06Udvcpu Firmware: through 20081
- Mitsubishielectric Q100Udehcpu Firmware: through 20101
- Mitsubishielectric Q10Udehcpu Firmware: through 20101
- Mitsubishielectric Q13Udehcpu Firmware: through 20101
- Mitsubishielectric Q13Udpvcpu Firmware: through 20081
- Mitsubishielectric Q13Udvcpu Firmware: through 20081
- Mitsubishielectric Q20Udehcpu Firmware: through 20101
- Mitsubishielectric Q26Udehcpu Firmware: through 20101
- Mitsubishielectric Q26Udpvcpu Firmware: through 20081
- Mitsubishielectric Q26Udvcpu Firmware: through 20081
- Mitsubishielectric Q50Udehcpu Firmware: through 20101
References
- http://www.securityfocus.com/bid/106771
- https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02
- http://www.securityfocus.com/bid/106771
- https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02
Get alerted when CVE-2019-6535 or the next vulnerability affects your stack