Industrial Threat Overview
Mitsubishi Electric Corporation, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), has issued a high-severity security advisory detailing a critical vulnerability (CVE-2026-78820, CVSS 9.3) affecting its flagship MELSEC-Q and MELSEC-L Series Programmable Logic Controllers (PLCs). The controllers are deployed globally across automotive manufacturing, water treatment, semiconductor fabrication, and automated logistics systems.
The flaw enables unauthenticated remote adversaries with access to the factory floor Ethernet network to send crafted Seamless Message Protocol (SLMP / MC Protocol) frames to the controller, corrupting internal CPU operational memory, causing unexpected PLC stop errors, or manipulating physical actuator output registers.
Protocol Mechanics & Root Cause (CWE-120 / CWE-20)
SLMP is an industrial Ethernet protocol developed by the CC-Link Partner Association that allows external human-machine interfaces (HMIs), supervisory SCADA servers, and vision inspection systems to read and write device memory registers inside Mitsubishi PLCs without specialized driver cards.
The vulnerability exists within the firmware parser responsible for processing SLMP 3E / 4E frame formats on TCP/UDP port 5007. When processing multi-point device batch write requests (command 1401), the communication processor fails to validate the correlation between the sub-command data length header and the actual frame payload size. By transmitting a frame with an inflated sub-command count followed by truncated payload blocks, an attacker triggers a heap buffer underflow during packet reassembly:
| PLC Module Series | Affected Hardware & Firmware | Remediated Firmware |
|---|---|---|
| MELSEC-Q Q03UDECPU, Q04UDEHCPU, Q06UDEHCPU | All serial numbers prior to 26081 | Firmware Version 26081 or later |
| MELSEC-Q Ethernet Module QJ71E71-100 | Function Version B and earlier | Apply security patch update |
| MELSEC-L L02CPU, L26CPU-BT | All firmware versions prior to v2.40 | Upgrade to v2.40 |
Operational Impact: Plant Downtime & Safety Hazard
Exploitation results in an immediate CPU watchdog timer fault (Error Code 4100 - OPERATION ERROR), forcing the controller into STOP mode. In an active production line or chemical batching process, an abrupt PLC halt can cause tool crashes, chemical mixture spoilage, or physical safety shutdowns requiring lengthy manual re-calibration.
IEC 62443 Defense-in-Depth Remediation Directives
Asset owners must execute the following remediation measures in accordance with IEC 62443-3-3 System Security Requirements:
- Firmware Flash Update: Upgrade all affected CPU and Ethernet communication modules to the latest patched firmware releases during scheduled maintenance turnarounds.
- Enable IP Packet Filtering: Utilize the built-in IP filtering feature in GX Works2 / GX Works3 to restrict SLMP communication on TCP/UDP port 5007 strictly to authorized engineering workstations and SCADA servers.
- Purdue Model Network Isolation: Ensure industrial automation networks (Purdue Level 1 and Level 2) are completely isolated from corporate Level 4 enterprise networks via industrial firewalls with deep packet inspection.
