# Mitsubishi Electric CNC Controllers Vulnerable to Remote Denial-of-Service via Malformed TCP Packets
## The Threat
Mitsubishi Electric has disclosed a remotely exploitable vulnerability in eighteen models of its CNC Series machine controllers that allows an unauthenticated attacker to crash the device by sending specially crafted packets to TCP port 683. The flaw, tracked as CVE-2025-2399, stems from improper validation of array indices and offsets in input data — a class of bug that triggers an out-of-bounds read and brings the controller to a halt.
CNC controllers sit at the heart of precision manufacturing: they drive machine tools, coordinate multi-axis cutting heads, and manage the tight feedback loops that turn raw stock into finished parts. A denial-of-service against one of these units doesn't just pause a software service — it stops physical production. Depending on the process, an abrupt controller shutdown mid-operation can also damage tooling, scrap in-progress workpieces, or create unsafe conditions for nearby workers.
What makes this particularly sharp is the attack surface. TCP port 683 is a dedicated Mitsubishi communications port used for remote connectivity to these controllers, and if that port is exposed on a plant network — or worse, reachable from outside — no credentials are required to exploit it. An attacker just needs to reach the port and send the right packets.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2025-2399 |
| CVSS v3 Score | 5.9 (Medium) |
| Vector String | CVSS:3.1/AV:N/AC:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Impact | Availability (Denial of Service) |
| Confidentiality / Integrity | None |
The CVSS score of 5.9 reflects the high attack complexity — triggering the out-of-bounds read requires crafted packets, not a trivial one-liner. But "Medium" severity scores can mislead in OT contexts. Availability is the primary concern for manufacturing equipment, and a score that would be routine for an enterprise web service represents a production stoppage in this environment.
## Affected Products
M800V / M80V Series (fix version: BC or later)
M800 / M80 / E80 Series (fix version: FN or later)
C80 Series *(no patch currently available)*
M750 / M730 / M720 / M70 / E70 Series (fix version: LK or later)
## Mitigations
Apply vendor patches where available. Mitsubishi Electric has released fixed firmware for most affected series:
Contact your Mitsubishi Electric representative for update delivery instructions, as firmware for CNC controllers typically follows a managed distribution process rather than a direct download.
For C80 controllers, no patch exists. Until one is available, defenders should treat this hardware as fully exposed and apply compensating controls aggressively.
Network controls are the critical backstop:
Mitsubishi Electric advises customers to restrict network access to affected products from untrusted networks and hosts as an interim measure. That's the minimum bar — network segmentation should already be standard practice for this class of equipment.
## References
---
## HackWire Analysis
The detail buried in this advisory that deserves more attention: the C80 controller is listed as "all versions affected" with no remediation path. That's not a firmware version range — that's a product line with no fix on the table. Organizations running C80 units are being told to apply compensating controls indefinitely, which in practice means permanent reliance on network segmentation to keep an exploitable port away from anything that can reach it.
That's a significant ask in real OT environments. Plant networks aren't always clean. IT/OT convergence initiatives, remote maintenance VPNs, and legacy flat networks create pathways that weren't supposed to exist but do. Every network pen test of a manufacturing facility turns up unexpected routes to production equipment. Port 683 doesn't need to be internet-facing to be exploitable — it just needs to be reachable from a compromised workstation running HMI software or an engineer's laptop on the same VLAN.
This advisory also fits a pattern that's been consistent for the past two years: ICS/OT vulnerabilities that score as "Medium" in CVSS because they're denial-of-service only, but carry outsized real-world impact in manufacturing and critical infrastructure. The CVSS scoring model was built for IT systems where availability impacts are recoverable. A CNC controller crash during an active machining operation is a different category of event — tooling damage, scrap, safety incidents, and hours of recovery time are all on the table.
Manufacturers running any of the eighteen affected models should treat this as a patch-priority item regardless of the Medium score. For C80 operators: network isolation isn't optional here, and it's worth auditing port 683 reachability right now rather than assuming segmentation is intact.
— HackWire Editorial
## Related Coverage