# CVE-2025-2399: Mitsubishi Electric CNC out-of-bounds read in network protocol handler

Source: https://junglewise.ai/threats/cve-2025-2399-mitsubishi-electric-cnc-out-of-bounds-read-in-network-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-2399 · Severity: medium · CVSS 5.9 · Published 2026-03-10

Mitsubishi Electric's CNC (Computer Numerical Control) machines are industrial controllers used to automate manufacturing equipment. An attacker can send malicious network packets to TCP port 683 that trigger an out-of-bounds memory read, causing the device to crash and stop functioning (denial of service). Recovery requires a manual system reset, potentially halting production operations.

Vendors: [Mitsubishi Electric](https://junglewise.ai/threats/vendors/mitsubishi-electric).

## Quick answers

**Is CVE-2025-2399 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-2399 being exploited in the wild.

**How severe is CVE-2025-2399?** Medium severity, with a CVSS score of 5.9, published 10 March 2026.

**Which products and versions are affected?** Mitsubishi Electric CNC C80 BND-2036W000-** all versions; Mitsubishi Electric CNC E70 BND-1022W000-** LJ edition and earlier; Mitsubishi Electric CNC E80 BND-2009W000-** FM edition and earlier; Mitsubishi Electric CNC M70V BND-1018W000-** LJ edition and earlier; and 14 more.

**Is there a fix for CVE-2025-2399?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-2399 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-2399?** Check whether you run Mitsubishi Electric CNC C80, Mitsubishi Electric CNC E70, Mitsubishi Electric CNC E80 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an out-of-bounds read (CWE-1285) caused by improper validation of input indices, positions, or offsets in the CNC network protocol handler. The vulnerability is remotely exploitable without authentication by sending specially crafted packets to TCP port 683. A successful exploit causes a denial-of-service condition that forces the affected CNC system into an emergency stop state and requires manual system reset for recovery. Patch availability varies by product line; some versions have fixes available while others have only mitigation strategies provided by Mitsubishi Electric.

## Affected products

- Mitsubishi Electric CNC M800VW BND-2051W000-** BB edition and earlier
- Mitsubishi Electric CNC M800VS BND-2052W000-** BB edition and earlier
- Mitsubishi Electric CNC M80V BND-2053W000-** BB edition and earlier
- Mitsubishi Electric CNC M80VW BND-2054W000-** BB edition and earlier
- Mitsubishi Electric CNC M800W BND-2005W000-** FM edition and earlier
- Mitsubishi Electric CNC M800S BND-2006W000-** FM edition and earlier
- Mitsubishi Electric CNC M80 BND-2007W000-** FM edition and earlier
- Mitsubishi Electric CNC M80W BND-2008W000-** FM edition and earlier
- Mitsubishi Electric CNC E80 BND-2009W000-** FM edition and earlier
- Mitsubishi Electric CNC C80 BND-2036W000-** all versions
- Mitsubishi Electric CNC M750VW BND-1015W002-** LJ edition and earlier
- Mitsubishi Electric CNC M730VW BND-1015W000-** LJ edition and earlier
- Mitsubishi Electric CNC M720VW BND-1015W000-** LJ edition and earlier
- Mitsubishi Electric CNC M750VS BND-1012W002-** LJ edition and earlier
- Mitsubishi Electric CNC M730VS BND-1012W000-** LJ edition and earlier
- Mitsubishi Electric CNC M720VS BND-1012W000-** LJ edition and earlier
- Mitsubishi Electric CNC M70V BND-1018W000-** LJ edition and earlier
- Mitsubishi Electric CNC E70 BND-1022W000-** LJ edition and earlier

## Timeline

- 2026-03-10: disclosed

## References

- [https://jvn.jp/vu/JVNVU95523788/](https://jvn.jp/vu/JVNVU95523788/)
- [https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-022_en.pdf](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-022_en.pdf)