Mitsubishi Electric’s multiple factory-automation products are affected by a vulnerability that could let a remote attacker disrupt communications or cause a denial-of-service condition with a specially crafted UDP packet, according to an updated industrial control systems advisory from the Cybersecurity and Infrastructure Security Agency.

Tracked as CVE-2025-3511, the vulnerability is rated 7.5 under the Common Vulnerability Scoring System. CISA classifies it as improper validation of specified quantity in input, or CWE-1284, and describes it as affecting the Ethernet function in multiple Mitsubishi Electric FA product families. The advisory identifies critical manufacturing as the affected sector and says the products are deployed worldwide.

The affected equipment includes CC-Link IE TSN Remote I/O modules, analog-to-digital and digital-to-analog converter modules, FPGA modules, and remote-station communication LSIs. The listed Remote I/O product lines include the NZ2GN2S1, NZ2GN2B1, NZ2GNCF1, NZ2GNCE3, NZ2GN12A4, NZ2GN12A2 and NZ2GN12A42 series.

CISA also lists the CC-Link IE TSN analog-to-digital converter modules NZ2GN2S-60AD4 and NZ2GN2B-60AD4, and the digital-to-analog converter modules NZ2GN2S-60DA4 and NZ2GN2B-60DA4. The affected FPGA modules are NZ2GN2S-D41P01, NZ2GN2S-D41D01 and NZ2GN2S-D41PD02. The advisory names the CC-Link IE TSN Remote Station Communication LSI models CP620 with GbE-PHY, including NZ2GACP620-300 and NZ2GACP620-60.

Other affected products include the MELSEC iQ-R Series CC-Link IE TSN Master/Local modules RJ71GN11-T2, RJ71GN11-EIP and RJ71GN11-SX; the MELSEC iQ-R Series Ethernet Interface Module RJ71EN71; and the CC-Link IE TSN master/local Station Communication LSI models NZ2GACP610-60 and NZ2KT-NPETNG51. The MELSEC iQ-F Series FX5 CC-Link IE TSN Master/Local Module FX5-CCLGN-MS is also included.

The list further covers the network parts of MELSEC iQ-R Series CPU modules R04ENCPU, R08ENCPU, R16ENCPU, R32ENCPU and R120ENCPU. The MELSEC iQ-F Series FX5 Ethernet Module FX5-ENET and FX5-ENET/IP Ethernet Module FX5-ENET/IP are affected as well.

The impact varies by product group. On the listed Remote I/O modules, converter modules, FPGA modules and CP620 communication LSIs, an attacker can send a specially crafted UDP packet and cause a denial-of-service condition if the product does not receive a valid UDP packet within three seconds.

On the listed MELSEC iQ-R CC-Link IE TSN Master/Local modules, the RJ71EN71 Ethernet Interface Module, the CP610 communication LSIs, the FX5-CCLGN-MS module and the network parts of the specified iQ-R CPU modules, a specially crafted UDP packet can also cause a denial-of-service condition. CISA says a system reset is required for recovery in those cases.

The FX5-ENET and FX5-ENET/IP modules have additional communication effects. A specially crafted UDP packet can cause a communication delay during Simple CPU communication. The same packet can cause a timeout error during CC-Link IEF Basic communication. CISA says communication will be restored when the affected product starts receiving valid UDP packets in the timeout scenario.

CISA lists vendor fixes for several product groups. Mitsubishi Electric is releasing fixed version 10 or later for the affected CC-Link IE TSN Remote I/O modules. Fixed version 08 or later is listed for the affected analog-to-digital and digital-to-analog converter modules. Fixed version 02 or later is listed for the three affected FPGA modules.

The CISA record identifies the notice as “Mitsubishi Electric Multiple FA Products (Update D)” and includes the affected-product and remediation information in its advisory.