CVE-2025-8531

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.

• CWE-130

• https://jvn.jp/vu/JVNVU97846038/
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-02
• https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-013_en.pdf

Published

Sep 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8525A vulnerability was found in Exrick xboot up to 3.3.4. It ha…5.5
• CVE-2025-8526A vulnerability was found in Exrick xboot up to 3.3.4. It ha…9.8
• CVE-2025-8527A vulnerability was found in Exrick xboot up to 3.3.4. It ha…8.8
• CVE-2025-8528A vulnerability classified as problematic has been found in …5.9
• CVE-2025-8529A vulnerability classified as critical was found in cloudfav…6.3
• CVE-2025-8530A vulnerability, which was classified as problematic, has be…7.5
• CVE-2025-8532Authorization Bypass Through User-Controlled Key, Improper A…6.4
• CVE-2025-8533A vulnerability was identified in the XPC services of Fantas…6.9
• CVE-2025-8534A vulnerability classified as problematic was found in libti…2.5
• CVE-2025-8535A vulnerability, which was classified as problematic, has be…9
• CVE-2025-8536A SQL injection vulnerability has been identified in DobryCM…9.3
• CVE-2025-8537A vulnerability, which was classified as problematic, was fo…5.9