CVE-2019-6535

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Mitsubishi Electric	Q03/04/06/13/26UDVCPU	<= serial number 20081
Mitsubishi Electric	Q04/06/13/26UDPVCPU	<= serial number 20081
Mitsubishi Electric	Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU	<= serial number 20101

References

http://www.securityfocus.com/bid/106771Third Party Advisory, VDB Entry
https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02
http://www.securityfocus.com/bid/106771Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-029-02Third Party Advisory, US Government Resource

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65367.8Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may CVE-2019-65377.8Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings wit CVE-2019-65386.5The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLi CVE-2019-65397.8Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbit CVE-2019-65406.5The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLi CVE-2019-65417.8A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code executio CVE-2019-65427.5ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated us CVE-2019-65439.8AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20 CVE-2019-65445.6GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform CVE-2019-65457.5AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20 CVE-2019-65467.8GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whi CVE-2019-65475.5Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the softw