CVE-2025-15080 Overview
CVE-2025-15080 is an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) affecting Mitsubishi Electric MELSEC iQ-R Series programmable logic controllers (PLCs). This vulnerability allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition by sending a specially crafted packet containing a specific command to the affected product.
This vulnerability is particularly concerning as it affects industrial control systems (ICS) used in critical infrastructure environments, where unauthorized access to control programs or denial of service conditions could have significant real-world consequences.
Critical Impact
Unauthenticated remote attackers can read/write device data, access control programs, or cause denial of service on critical industrial control systems without any user interaction required.
Affected Products
- Mitsubishi Electric MELSEC iQ-R Series R08PCPU
- Mitsubishi Electric MELSEC iQ-R Series R16PCPU
- Mitsubishi Electric MELSEC iQ-R Series R32PCPU
- Mitsubishi Electric MELSEC iQ-R Series R120PCPU
Discovery Timeline
- 2026-02-05 - CVE-2025-15080 published to NVD
- 2026-02-05 - Last updated in NVD database
Technical Details for CVE-2025-15080
Vulnerability Analysis
This vulnerability exists due to improper validation of specified quantity in input within the MELSEC iQ-R Series CPU modules. The affected products fail to properly validate input quantities in network packets, allowing attackers to manipulate device behavior through malformed requests. The vulnerability is exploitable over the network without requiring authentication or user interaction, making it a significant threat to industrial environments where these PLCs are deployed.
The attack can result in three distinct impact scenarios: reading sensitive device data or portions of control programs (information disclosure), writing arbitrary device data (integrity violation), or triggering a denial of service condition that disrupts normal operations (availability impact).
Root Cause
The root cause is classified as CWE-1284: Improper Validation of Specified Quantity in Input. The affected CPU modules do not adequately validate the quantity values specified in incoming network packets before processing commands. This allows attackers to craft packets with manipulated quantity fields that bypass security controls and gain unauthorized access to device functions.
When the firmware receives a specially crafted packet, it processes the command without verifying that the specified quantities are within expected bounds, leading to unauthorized read/write operations or system instability.
Attack Vector
The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to the affected PLC can send specially crafted packets containing specific commands to exploit the vulnerability.
The attack methodology involves:
- Identifying target MELSEC iQ-R Series devices on the network
- Crafting malicious packets with manipulated quantity values targeting specific device commands
- Sending the packets directly to the affected PLC
- Achieving unauthorized data access, data modification, or service disruption
Due to the sensitive nature of ICS environments, technical exploitation details are not provided. For additional technical information, refer to the Mitsubishi Electric Security Notice and the JVN Vulnerability Information.
Detection Methods for CVE-2025-15080
Indicators of Compromise
- Unusual network traffic patterns targeting MELSEC iQ-R Series devices on industrial networks
- Unexpected read or write operations on PLC device data or control programs
- PLC devices entering fault states or experiencing unexpected restarts
- Anomalous command sequences in network packet captures to affected CPU modules
Detection Strategies
- Deploy network intrusion detection systems (NIDS) with rules specific to MELSEC/SLMP protocol anomalies
- Monitor for unauthorized access attempts to PLC programming interfaces from untrusted network segments
- Implement deep packet inspection for industrial protocol traffic to detect malformed quantity values
- Configure SIEM alerts for unusual access patterns to industrial control systems
Monitoring Recommendations
- Establish baseline network behavior for MELSEC iQ-R communications and alert on deviations
- Log and monitor all network connections to affected PLC devices from non-engineering workstations
- Implement continuous monitoring of PLC program integrity using checksum verification
- Enable enhanced logging on network devices segmenting ICS environments from corporate networks
How to Mitigate CVE-2025-15080
Immediate Actions Required
- Isolate affected MELSEC iQ-R Series devices from untrusted networks and the internet immediately
- Implement network segmentation to restrict access to PLCs to authorized engineering workstations only
- Enable firewall rules to block unauthorized network access to the affected CPU modules
- Review access logs for any indication of exploitation attempts prior to mitigation
Patch Information
Mitsubishi Electric has released a security advisory addressing this vulnerability. Organizations should review the Mitsubishi Electric Security Notice for specific patch and firmware update information. Contact Mitsubishi Electric support for guidance on obtaining and applying the appropriate security updates for your specific CPU module model.
Additional vulnerability details are available in the JVN Vulnerability Information.
Workarounds
- Implement strict network segmentation to isolate MELSEC iQ-R Series devices from untrusted networks
- Use firewall rules or access control lists to permit connections only from authorized IP addresses
- Deploy a VPN or other encrypted tunnel for remote access to ICS environments
- Enable IP filtering features on the PLC if supported by the device configuration
- Consider implementing an industrial demilitarized zone (IDMZ) architecture to further protect control systems
# Network segmentation example using iptables
# Allow only authorized engineering workstation access to PLC network segment
iptables -A FORWARD -s 10.10.10.50 -d 192.168.100.0/24 -p tcp --dport 5007 -j ACCEPT
iptables -A FORWARD -d 192.168.100.0/24 -p tcp --dport 5007 -j DROP
# Replace 10.10.10.50 with authorized workstation IP
# Replace 192.168.100.0/24 with PLC network segment
# Replace port 5007 with actual MELSEC communication port in use
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
