Denial of service in Mitsubishi Electric CNC Series
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-7316 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
M800VW Hardware solutions / Firmware M800VS Hardware solutions / Firmware M80V Hardware solutions / Firmware M80VW Hardware solutions / Firmware M800W Hardware solutions / Firmware M800S Hardware solutions / Firmware M80 Hardware solutions / Firmware M80W Hardware solutions / Firmware E80 Hardware solutions / Firmware C80 Hardware solutions / Firmware M750VW Hardware solutions / Firmware M730VW Hardware solutions / Firmware M720VW Hardware solutions / Firmware M750VS Hardware solutions / Firmware M730VS Hardware solutions / Firmware M720VS Hardware solutions / Firmware M70V Hardware solutions / Firmware E70 Hardware solutions / Firmware NC Trainer2 Hardware solutions / Firmware NC Trainer2 plus Hardware solutions / Firmware |
| Vendor | Mitsubishi Electric |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU99233
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-7316
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Numerical Control Systems (CNC). A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsM800VW: All versions
M800VS: All versions
M80V: All versions
M80VW: All versions
M800W: All versions
M800S: All versions
M80: All versions
M80W: All versions
E80: All versions
C80: All versions
M750VW: All versions
M730VW: All versions
M720VW: All versions
M750VS: All versions
M730VS: All versions
M720VS: All versions
M70V: All versions
E70: All versions
NC Trainer2: All versions
NC Trainer2 plus: All versions
CPE2.3- cpe:2.3:h:mitsubishi_electric:m800vw:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m800vs:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m80v:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m80vw:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m800w:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m800s:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m80:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m80w:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:e80:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:c80:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m750vw:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m730vw:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m720vw:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m750vs:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m730vs:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m720vs:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:m70v:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:e70:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:nc_trainer2:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:nc_trainer2_plus:*:*:*:*:*:*:*:*
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-007_en.pdf
https://jvn.jp/vu/JVNVU92054409/index.html
https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-03
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
