CVE-2025-15080
Improper Input Validation in Mitsubishi MELSEC iQ-R Enables DoS, Data Access
Publication date: 2026-02-05
Last updated on: 2026-02-06
Assigner: Mitsubishi Electric Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitsubishi_electric | melsec_iq-r_series | r08pcpu |
| mitsubishi_electric | melsec_iq-r_series | r16pcpu |
| mitsubishi_electric | melsec_iq-r_series | r32pcpu |
| mitsubishi_electric | melsec_iq-r_series | to 49 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15080 is a vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU devices caused by improper validation of specified quantity in input. This flaw allows an unauthenticated attacker to send specially crafted packets containing specific commands to the affected devices.
Due to this improper input validation, the attacker can read device data or parts of control programs, write device data, or cause a denial of service (DoS) condition on the affected product.
How can this vulnerability impact me? :
This vulnerability can have several serious impacts including:
- Unauthorized reading of device data or parts of control programs, potentially exposing sensitive information.
- Unauthorized writing or tampering with device data, which can affect the integrity of the system.
- Denial of Service (DoS) conditions that disrupt the normal operation and availability of the affected devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate the vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08/16/32/120PCPU devices, immediately update the firmware to version "49" or later.'}, {'type': 'paragraph', 'content': 'Additional recommended mitigations include:'}, {'type': 'list_item', 'content': 'Use firewalls or VPNs to restrict unauthorized network access.'}, {'type': 'list_item', 'content': 'Operate the affected products within a trusted LAN environment and block untrusted network access.'}, {'type': 'list_item', 'content': "Employ IP filters as described in the MELSEC iQ-R Ethernet User's Manual."}, {'type': 'list_item', 'content': 'Restrict physical access to the devices and connected LANs.'}, {'type': 'paragraph', 'content': 'For further assistance, contact your local Mitsubishi Electric representative.'}] [1]