Vulnerability-Lookup

VAR-201902-0127

Vulnerability from variot - Updated: 2025-06-27 23:05

Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication. plural Mitsubishi Electric Q Series products are vulnerable to resource exhaustion.Service operation interruption (DoS) There is a possibility of being put into a state. Mitsubishi Electric MELSEC-Q Series PLCs are prone to an remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. Misubishi Electric Q03UDVCPU, etc. are all PLC (programmable logic controller) products of Japan's Mitsubishi Electric (Misubishi Electric) company. Security flaws exist in several Misubishi products. A remote attacker could exploit this vulnerability by sending a specially crafted packet to cause Ethernet to stop communicating. The following products are affected: Misubishi Q03UDVCPU; Q04UDVCPU; Q06UDVCPU; Q13UDVCPU; Q26UDPVCPU; Q03UDECPU;

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201902-0127",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "q06udpvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q100udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q26udvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q13udvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q04udpvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q26udpvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q04udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q20udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q10udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q06udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q06udvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q26udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q13udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q04udvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q03udecpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q50udehcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20101"
      },
      {
        "model": "q03udvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q13udpvcpu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "20081"
      },
      {
        "model": "q03udecpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q03udvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q04udpvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q04udvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q06udpvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q06udvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q13udpvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q13udvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q26udpvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "q26udvcpu",
        "scope": null,
        "trust": 0.8,
        "vendor": "mitsubishi electric",
        "version": null
      },
      {
        "model": "electric q04/06/13/26udpvcpu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mitsubishi",
        "version": "20081"
      },
      {
        "model": "electric q04/06/10/13/20/26/50/100udehcpu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mitsubishi",
        "version": "20101"
      },
      {
        "model": "electric q03udecpu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mitsubishi",
        "version": "20101"
      },
      {
        "model": "electric q03/04/06/13/26udvcpu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mitsubishi",
        "version": "20081"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q03udecpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q03udvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q04udpvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q04udvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q06udpvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q06udvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q13udpvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q13udvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q26udpvcpu_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:mitsubishielectric:q26udvcpu_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tri Quach of Amazon???s Customer Fulfillment Technology Security (CFTS),Tri Quach of Amazon???s Customer Fulfillment Technology Security (CFTS)",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-6535",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2019-6535",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-157970",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2019-6535",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-6535",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-6535",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ics-cert@hq.dhs.gov",
            "id": "CVE-2019-6535",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-6535",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201901-973",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-157970",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication. plural Mitsubishi Electric Q Series products are vulnerable to resource exhaustion.Service operation interruption (DoS) There is a possibility of being put into a state. Mitsubishi Electric MELSEC-Q Series PLCs are prone to an remote denial-of-service vulnerability. \nAn attacker can exploit this issue to cause a denial-of-service condition. Misubishi Electric Q03UDVCPU, etc. are all PLC (programmable logic controller) products of Japan\u0027s Mitsubishi Electric (Misubishi Electric) company. Security flaws exist in several Misubishi products. A remote attacker could exploit this vulnerability by sending a specially crafted packet to cause Ethernet to stop communicating. The following products are affected: Misubishi Q03UDVCPU; Q04UDVCPU; Q06UDVCPU; Q13UDVCPU; Q26UDPVCPU; Q03UDECPU;",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "BID",
        "id": "106771"
      },
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6535",
        "trust": 2.8
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-19-029-02",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "106771",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973",
        "trust": 0.7
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-98808",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-157970",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "db": "BID",
        "id": "106771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "id": "VAR-201902-0127",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      }
    ],
    "trust": 0.85
  },
  "last_update_date": "2025-06-27T23:05:24.314000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "MELSEC-Q\u30b7\u30ea\u30fc\u30ba",
        "trust": 0.8,
        "url": "https://www.mitsubishielectric.co.jp/fa/products/cnt/plcq/items/index.html"
      },
      {
        "title": "Multiple Misubishi Product security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89040"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-029-02"
      },
      {
        "trust": 2.3,
        "url": "http://www.securityfocus.com/bid/106771"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6535"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6535"
      },
      {
        "trust": 0.3,
        "url": "http://www.mitsubishi-automation.com/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "db": "BID",
        "id": "106771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "db": "BID",
        "id": "106771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-02-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "date": "2019-01-29T00:00:00",
        "db": "BID",
        "id": "106771"
      },
      {
        "date": "2019-03-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "date": "2019-01-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "date": "2019-02-05T19:29:00.243000",
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157970"
      },
      {
        "date": "2019-01-29T00:00:00",
        "db": "BID",
        "id": "106771"
      },
      {
        "date": "2019-03-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      },
      {
        "date": "2025-06-26T18:15:21.017000",
        "db": "NVD",
        "id": "CVE-2019-6535"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Mitsubishi Electric Q Vulnerability related to resource depletion in series products",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001917"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-973"
      }
    ],
    "trust": 0.6
  }
}

CVE-2019-6535 (GCVE-0-2019-6535)

Vulnerability from cvelistv5 – Published: 2019-02-05 19:00 – Updated: 2025-06-26 17:08

Title

Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 350 records in the last 180 days details

References

3 references

URL	Tags
http://www.securityfocus.com/bid/106771	vdb-entryx_refsource_BID
https://www.cisa.gov/news-events/ics-advisories/i…	x_refsource_MISC
https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02	x_refsource_MISCx_transferred

Impacted products

3 products

Vendor	Product	Version
Mitsubishi Electric	Q03/04/06/13/26UDVCPU	Affected: 0 , ≤ serial number 20081 (custom)
Mitsubishi Electric	Q04/06/13/26UDPVCPU	Affected: 0 , ≤ serial number 20081 (custom)
Mitsubishi Electric	Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU	Affected: 0 , ≤ serial number 20101 (custom)

Date Public

2019-01-29 07:00

Credits

Tri Quach of Amazon's Customer Fulfillment Technology Security (CFTS) group reported this vulnerability to the National Cybersecurity and Communications Integration Center (NCCIC).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:23:21.974Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106771",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106771"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Q03/04/06/13/26UDVCPU",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "lessThanOrEqual": "serial number 20081",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Q04/06/13/26UDPVCPU",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "lessThanOrEqual": "serial number 20081",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU",
          "vendor": "Mitsubishi Electric",
          "versions": [
            {
              "lessThanOrEqual": "serial number 20101",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tri Quach of Amazon\u0027s Customer Fulfillment Technology Security (CFTS) group reported this vulnerability to the National Cybersecurity and Communications Integration Center (NCCIC)."
        }
      ],
      "datePublic": "2019-01-29T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\nMitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication.\n\n\u003c/p\u003e"
            }
          ],
          "value": "Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-26T17:08:15.995Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "106771",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106771"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMitsubishi Electric has produced a new version of the firmware. Additional information about this vulnerability or Mitsubishi Electric\u0027s compensating control is available by contacting a local Mitsubishi Electric representative, which can be found at the following location: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://us.mitsubishielectric.com/fa/en/about-us/distributors\"\u003ehttps://us.mitsubishielectric.com/fa/en/about-us/distributors\u003c/a\u003e\u003c/p\u003e\u003cp\u003eMitsubishi Electric strongly recommends users should operate the affected device behind a firewall.\u003c/p\u003e"
            }
          ],
          "value": "Mitsubishi Electric has produced a new version of the firmware. Additional information about this vulnerability or Mitsubishi Electric\u0027s compensating control is available by contacting a local Mitsubishi Electric representative, which can be found at the following location:  https://us.mitsubishielectric.com/fa/en/about-us/distributors \n\nMitsubishi Electric strongly recommends users should operate the affected device behind a firewall."
        }
      ],
      "source": {
        "advisory": "ICSA-19-029-02",
        "discovery": "EXTERNAL"
      },
      "title": "Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2019-01-29T00:00:00",
          "ID": "CVE-2019-6535",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior.",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICS-CERT"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "UNCONTROLLED RESOURCE CONSUMPTION (\u0027RESOURCE EXHAUSTION\u0027) CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106771",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106771"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2019-6535",
    "datePublished": "2019-02-05T19:00:00.000Z",
    "dateReserved": "2019-01-22T00:00:00.000Z",
    "dateUpdated": "2025-06-26T17:08:15.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted