What’s Vulnerable › Vulnerabilities

CVE-2024-0803

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-15 · updated 2026-06-17
• Weakness: CWE-190

Description

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

Affected products

• Mitsubishi Melsec L06Cpu(-P): before xxxxx26041 — fixed in xxxxx26041
• Mitsubishi Melsec L26Cpu(-P): before xxxxx26041 — fixed in xxxxx26041
• Mitsubishi Melsec Q03Udvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q04Udvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q06Udpvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q06Udvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q13Udpvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q13Udvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q26Udpvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishi Melsec Q26Udvcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric L02Cpu-P: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric L26Cpu-Bt: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric Melsec L02Cpu-P: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric Melsec L06Cpu-P: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric Melsec L26Cpu-P: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric Melsec L26Cpu-Pbt: before xxxxx26041 — fixed in xxxxx26041
• Mitsubishielectric Melsec Q-Q03Udecpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q04Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q06Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q100Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q10Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q13Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q20Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q26Udehcpu: before xxxxx26061 — fixed in xxxxx26061
• Mitsubishielectric Melsec Q-Q50Udehcpu: before xxxxx26061 — fixed in xxxxx26061

How to fix

Upgrade to a fixed version: Mitsubishi Melsec L06Cpu(-P) xxxxx26041; Mitsubishi Melsec L26Cpu(-P) xxxxx26041; Mitsubishi Melsec Q03Udvcpu xxxxx26061; Mitsubishi Melsec Q04Udvcpu xxxxx26061; Mitsubishi Melsec Q06Udpvcpu xxxxx26061; Mitsubishi Melsec Q06Udvcpu xxxxx26061; Mitsubishi Melsec Q13Udpvcpu xxxxx26061; Mitsubishi Melsec Q13Udvcpu xxxxx26061; Mitsubishi Melsec Q26Udpvcpu xxxxx26061; Mitsubishi Melsec Q26Udvcpu xxxxx26061; Mitsubishielectric L02Cpu-P xxxxx26041; Mitsubishielectric L26Cpu-Bt xxxxx26041. Check the vendor advisory for mitigations.

References

• https://jvn.jp/vu/JVNVU99690199/
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
• https://jvn.jp/vu/JVNVU99690199/
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf

Get alerted when CVE-2024-0803 or the next vulnerability affects your stack