Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q…
Priority MEDIUM 51CWE-468Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01066 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | MELSEC-Q Series Q03UDECPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q04UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q06UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q10UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q13UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q20UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q26UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q50UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q100UDEHCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q03UDVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q04UDVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q06UDVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q13UDVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q26UDVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q04UDPVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q06UDPVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q13UDPVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-Q Series Q26UDPVCPU | The first 5 digits of serial No. "26061" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L02CPU | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L06CPU | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L26CPU | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L02CPU-P | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L06CPU-P | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L26CPU-P | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L26CPU-BT | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC-L Series L26CPU-PBT | The first 5 digits of serial No. "26041" and prior | — | No fix listed | CNA |
- MELSEC-Q Series Q03UDECPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q04UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q06UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q10UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q13UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q20UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q26UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q50UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q100UDEHCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q03UDVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q04UDVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q06UDVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q13UDVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q26UDVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q04UDPVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q06UDPVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q13UDPVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-Q Series Q26UDPVCPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26061" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L02CPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L06CPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L26CPU VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L02CPU-P VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L06CPU-P VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L26CPU-P VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L26CPU-BT VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
- MELSEC-L Series L26CPU-PBT VendorMitsubishi Electric Corporation Affected The first 5 digits of serial No. "26041" and prior Fixed in — No fix listed CNA
CPE names CISA-ADP · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:mitsubishielectric:melsec_q-q03udecpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q04udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q06udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q10udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q13udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q20udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q26udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q50udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_q-q100udehcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishi:melsec_q03udvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
- cpe:2.3:h:mitsubishielectric:melsec_q-q03udecpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q04udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q06udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q10udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q13udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q20udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q26udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q50udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_q-q100udehcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishi:melsec_q03udvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:mitsubishi:melsec_q04udvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q06udvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q13udvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q26udvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q06udpvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q13udpvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_q26udpvcpu:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishielectric:l02cpu-p:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishi:melsec_l06cpu\(-p\):-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishi:melsec_l26cpu\(-p\):-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi |
| cpe:2.3:h:mitsubishielectric:melsec_l02cpu-p:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_l06cpu-p:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_l26cpu-p:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:l26cpu-bt:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
| cpe:2.3:h:mitsubishielectric:melsec_l26cpu-pbt:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Mitsubishi Electric Europe B.V. |
- cpe:2.3:h:mitsubishi:melsec_q04udvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q06udvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q13udvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q26udvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q06udpvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q13udpvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_q26udpvcpu:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishielectric:l02cpu-p:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishi:melsec_l06cpu\(-p\):-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishi:melsec_l26cpu\(-p\):-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi
- cpe:2.3:h:mitsubishielectric:melsec_l02cpu-p:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_l06cpu-p:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_l26cpu-p:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:l26cpu-bt:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
- cpe:2.3:h:mitsubishielectric:melsec_l26cpu-pbt:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Mitsubishi Electric MELSEC-L Series L02CPU, MELSEC-L Series L02CPU-P and 24 more products — mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_…
5 records Highest priority Priority MEDIUM 5 MEDIUM
Other records, highest priority first
- TI-2024-01784 Integer overflow in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPUPriority MEDIUM 51
- TI-2024-01783 Integer overflow in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPUPriority MEDIUM 51
- TI-2024-00740 Integer overflow in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDECPUPriority MEDIUM 51
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0802
- 2026-10-03 Alias added: GHSA-qprp-wpvg-34qr
References
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-0802 · CVE Program
- CVE-2024-0802 · NVD
- FIRST EPSS
- GHSA-qprp-wpvg-34qr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences