CVE Intelligence
Skip to main content
CRITICAL

CVE-2024-1917

CVE-2024-1917 Vulnerability Analysis & Exploit Intelligence

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

Published Updated Sources: cvelistV5, Mitsubishi

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

1%

chance of exploitation in 30 days

Affects

mitsubishi electric

49 products listed

CVSS base

9.8

CRITICAL

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

Yes

can an attacker script all four kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Products (49)

melsec q series q03udecpumelsec q series q04udehcpumelsec q series q06udehcpumelsec q series q10udehcpumelsec q series q13udehcpumelsec q series q20udehcpumelsec q series q26udehcpumelsec q series q50udehcpumelsec q series q100udehcpumelsec q series q03udvcpumelsec q series q04udvcpumelsec q series q06udvcpumelsec q series q13udvcpumelsec q series q26udvcpumelsec q series q04udpvcpumelsec q series q06udpvcpumelsec q series q13udpvcpumelsec q series q26udpvcpumelsec l series l02cpumelsec l series l06cpumelsec l series l26cpumelsec l series l02cpu pmelsec l series l06cpu pmelsec l series l26cpu pmelsec l series l26cpu btmelsec l series l26cpu pbtmelsec q q03udecpumelsec q q04udehcpumelsec q q06udehcpumelsec q q10udehcpumelsec q q13udehcpumelsec q q20udehcpumelsec q q26udehcpumelsec q q50udehcpumelsec q q100udehcpumelsec q03udvcpumelsec q04udvcpumelsec q06udvcpumelsec q13udvcpumelsec q26udvcpumelsec q06udpvcpumelsec q13udpvcpumelsec q26udpvcpul02cpu pmelsec l06cpu pmelsec l26cpu pmelsec l02cpu pl26cpu btmelsec l26cpu pbt

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
9.8CVSS 3.1CRITICAL——cvelistV5

Weakness & attack patterns

  • CWE-190

References

3 on the record

Elsewhere on this site

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.