By sending specially crafted packets to TCP port 683, a remote attacker can induce an out-of-bounds read, resulting in a denial-of-service (DoS) condition. This vulnerability poses a risk to critical manufacturing environments where these CNC controllers are deployed. Defenders should focus on isolating affected hardware from untrusted networks and restricting access to TCP port 683. Patches are available from Mitsubishi Electric, and organizations should prioritize updates to the specified versions (BC, FN, or LK, depending on the product series) or apply the recommended IP filtering and network segmentation mitigations.

Impact

The successful exploitation of CVE-2025-2399 results in a denial-of-service, which in an industrial manufacturing context can lead to unplanned downtime, loss of production, and disruption of automated machining processes. The vulnerability is rated with a CVSS 3.1 score of 5.9 (Medium), reflecting that while exploitation is remote, it requires specific technical craft to trigger the DoS condition. The affected devices are deployed globally in the critical manufacturing sector.

Recommendation

• Apply the vendor-provided firmware updates (version BC, FN, or LK) appropriate for the specific CNC controller model.
• Isolate CNC controller networks from the enterprise network using firewalls or VPNs to prevent unauthorized access to TCP port 683.
• Implement IP address filtering on the affected controllers using the manufacturer's built-in functions to restrict communication to known-authorized endpoints.
• Restrict physical access to CNC hardware and connected network infrastructure.
• Deploy network intrusion detection systems to alert on abnormal traffic patterns directed at TCP port 683.

Impact

The vulnerability impacts industrial control system infrastructure globally within the critical manufacturing sector. Successful exploitation results in a loss of network communication for critical I/O modules, CPUs, and interface modules. In many cases, a hardware reset is required to restore normal operations, which could lead to unplanned downtime and disruption of manufacturing processes.

Recommendation

• Identify all affected Mitsubishi Electric FA hardware using the provided product list and ensure internal inventory reflects the specified vulnerable firmware versions.
• Implement network segmentation to isolate industrial Ethernet traffic, restricting access to these devices from untrusted network segments.
• Monitor for anomalous UDP traffic patterns originating from unauthorized sources directed toward industrial Ethernet interfaces.
• Prioritize firmware updates as provided by Mitsubishi Electric to address CVE-2025-3511 across the entire affected product line.