CVE-2025-2399: Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series

Medium severity · published Mar 10, 2026

CVE-2025-2399

Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series

5.9

CVSS

0.5%

EPSS

On KEV

Description

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 46% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Mitsubishi Electric CNC C80 Series C80 · Mitsubishi Electric Corporation

System Number BND-2036W000 all versions · source: vendor

Mitsubishi Electric CNC E70 Series E70 · Mitsubishi Electric Corporation

System Number BND-1022W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC E80 Series E80 · Mitsubishi Electric Corporation

System Number BND-2009W000 versions FM and prior · source: vendor

Mitsubishi Electric CNC M700V Series M720VS · Mitsubishi Electric Corporation

System Number BND-1012W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M700V Series M720VW · Mitsubishi Electric Corporation

System Number BND-1015W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M700V Series M730VS · Mitsubishi Electric Corporation

System Number BND-1012W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M700V Series M730VW · Mitsubishi Electric Corporation

System Number BND-1015W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M700V Series M750VS · Mitsubishi Electric Corporation

System Number BND-1012W002 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M700V Series M750VW · Mitsubishi Electric Corporation

System Number BND-1015W002 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M70V Series M70V · Mitsubishi Electric Corporation

System Number BND-1018W000 versions LJ and prior · source: vendor

Mitsubishi Electric CNC M80 Series M80 · Mitsubishi Electric Corporation

System Number BND-2007W000 versions FM and prior · source: vendor

Mitsubishi Electric CNC M80 Series M80W · Mitsubishi Electric Corporation

System Number BND-2008W000 versions FM and prior · source: vendor

In the news

VulnerabilityMedium

Mitsubishi Electric CNC Series

View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products. The following versions of Mitsubishi Electric CNC Series are affected: M800VW (BND-2051W000) <=BB M800VS (BND-2052W000) <=BB M80V (BND-2053W000) <=BB M80VW (BND-2054W000) <=BB M800W (BND-2005W000) <=FM M800S (BND-2006W000) <=FM M80 (BND-2007W000) <=FM M80W (BND-2008W000) <=FM E80 (BND-2009W000) <=FM C80 (BND-2036W000) vers:all/* M750VW (BND-1015W002) vers:all/* M730VW (BND-1015W000) vers:all/* M720VW (BND-1015W000) vers:all/* M750VS (BND-1012W002) vers:all/* M730VS (BND-1012W000-**) vers:all/* M720VS (BND-1012W000) vers:all/* M70V (BND-1018W000) vers:all/* E70 (BND-1022W000) vers:all/* NC Trainer2 (BND-1802W000) vers:all/* NC Trainer2 plus (BND-1803W000) vers:all/* CVSS Vendor Equipment Vulnerabilities v3 5.9 Mitsubishi Electric Mitsubishi Electric CNC Series Improper Validation of Specified Index, Position, or Offset in Input Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan Vulnerabilities Expand All + CVE-2025-2399 Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) vulnerability in the affected products allow...

CVE-2025-2399

Mar 19, 2026·CISA Advisories

Affected product

Mitsubishi Electric CNC C80 Series C80

Mitsubishi Electric Corporation

All Mitsubishi Electric CNC C80 Series C80 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-2399

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-2399

jvn.jp