Input validation error in Mitsubishi Electric products - CVE-2024-7316

Vulnerability identifier: #VU99233

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-7316

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Numerical Control Systems (CNC). A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

M750VW
NC Trainer2 plus
NC Trainer2
E70
M70V
M720VS
M730VS
M750VS
M720VW
M730VW
M800VW
C80
E80
M80W
M80
M800S
M800W
M80VW
M80V
M800VS

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-007_en.pdf
• https://jvn.jp/vu/JVNVU92054409/index.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-03

• Denial of service in Mitsubishi Electric CNC Series