CVE-2025-3511

HighCVSS 7.5/10Last modified Aug 27, 2026

Description

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter module, CC-Link IE TSN Digital-Analog Converter module, CC-Link IE TSN FPGA module, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY, MELSEC iQ-R Series CC-Link IE TSN Master/Local Module, MELSEC iQ-R Series Ethernet Interface Module, CC-Link IE TSN Master/Local Station Communication LSI CP610, MELSEC iQ-F Series FX5 CC-Link IE TSN Master/Local Module, MELSEC iQ-F Series FX5 Ethernet Module, MELSEC iQ-F Series FX5-ENET/IP Ethernet Module, and MELSEC iQ-R Series CPU module allows a remote unauthenticated attacker to cause a Denial of Service condition in the products by sending specially crafted UDP packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

VendorProductVersions
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-32D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-32T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-32TE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-32DT09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-32DTE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-32D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-32T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-32TE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-32DT09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-32DTE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GNCF1-32D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GNCF1-32T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GNCE3-32D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GNCE3-32DT09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A4-16D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A4-16DE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A2-16T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A2-16TE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A42-16DT09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN12A42-16DTE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-16D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-16T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2S1-16TE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-16D09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-16T09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote I/O module NZ2GN2B1-16TE09 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Analog-Digital Converter module NZ2GN2S-60AD407 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Analog-Digital Converter module NZ2GN2B-60AD407 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Digital-Analog Converter module NZ2GN2S-60DA407 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Digital-Analog Converter module NZ2GN2B-60DA407 and prior
Mitsubishi Electric CorporationCC-Link IE TSN FPGA module NZ2GN2S-D41P0101
Mitsubishi Electric CorporationCC-Link IE TSN FPGA module NZ2GN2S-D41D0101
Mitsubishi Electric CorporationCC-Link IE TSN FPGA module NZ2GN2S-D41PD0201
Mitsubishi Electric CorporationCC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-3001.08J and prior
Mitsubishi Electric CorporationCC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-601.08J and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-T226 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-EIP10 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-SX05 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series Ethernet Interface Module RJ71EN7185 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Master/Local Station Communication LSI CP610 NZ2GACP610-6005 and prior
Mitsubishi Electric CorporationCC-Link IE TSN Master/Local Station Communication LSI CP610 NZ2KT-NPETNG5105 and prior
Mitsubishi Electric CorporationMELSEC iQ-F Series FX5 CC-Link IE TSN Master/Local Module FX5-CCLGN-MS1.020 and prior
Mitsubishi Electric CorporationMELSEC iQ-F Series FX5 Ethernet Module FX5-ENET1.200 and prior
Mitsubishi Electric CorporationMELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP1.106 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CPU module R04ENCPU (Network part)85 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CPU module R08ENCPU (Network part)85 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CPU module R16ENCPU (Network part)85 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CPU module R32ENCPU (Network part)85 and prior
Mitsubishi Electric CorporationMELSEC iQ-R Series CPU module R120ENCPU (Network part)85 and prior

References

Timeline

Published
Apr 25, 2025
Last modified
Aug 27, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-351124.9Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacCVE-2025-351137.2Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieCVE-2025-351147.5Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is knowCVE-2025-351158.1Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could reCVE-2025-35124.8There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be pasCVE-2025-35133.5The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35143.5The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35159.8The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient fCVE-2025-35165.9The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/CVE-2025-35176.3Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a prevCVE-2025-35184.3It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file uploadCVE-2025-35197.0An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in
CVE-2025-3511: High severity, CVSS 7.5 | Vulnix