CVE-2025-15080 Other in MELSEC iQ-R Series R08PCPU
Unauthenticated attackers can read or modify device data and cause denial of service on Mitsubishi MELSEC iQ-R PLCs via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15080?
CVE-2025-15080 is a high-severity vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R08PCPU, published on 5 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.
Weakness: CWE-1284
Which versions are affected by CVE-2025-15080?
How do I fix CVE-2025-15080?
No fix has been published for CVE-2025-15080 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15080 being exploited?
There is no known exploitation of CVE-2025-15080 in the wild and no public exploit code.
Sources
Also known as GHSA-3pq4-wgqv-gq3h.