Memory corruption vulnerability in Mitsubishi PLC could lead to DoS, code execution

Summary: Cisco Talos discovered a buffer overflow vulnerability, TALOS-2023-1727 (CVE-2023-1424), in the Mitsubishi MELSEC iQ-F FX5U programmable logic controller's MELSOFT Direct functionality, triggered by a specially crafted network packet. The flaw can cause a denial-of-service condition in the RTOS task that parses the MELSOFT Direct protocol and may allow an adversary to execute remote code on the device.
Why it matters: Talos confirmed the exploit against FX5U versions 1.240 and 1.260, and Mitsubishi's advisory states versions 1.220 and later are affected, so any controller on those firmware versions carries a remotely reachable path to a crash or code execution.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-1424
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026