Loading story…
Mitsubishi Electric issued a security advisory for MELSEC iQ-F Series communications modules—FX5-ENET/IP Ethernet Module and FX5-EIP EtherNet/IP Module—warning of multiple vulnerabilities in their Ethernet/EtherNet/IP functions that can be triggered remotely to cause denial of service (DoS). The Canadian Centre for Cyber Security relayed the advisory and urged operators to review Mitsubishi Electric’s guidance and apply the recommended updates/mitigations, given the operational impact to industrial control environments.
Two CVEs describe the primary DoS conditions: CVE-2026-1874 affects FX5-ENET/IP (versions 1.106 and prior) and FX5-EIP (all versions) and is characterized as an always-incorrect control flow implementation issue (CWE-670), while CVE-2026-1875 affects FX5-EIP (all versions) and is described as improper resource shutdown or release (CWE-404). In both cases, an unauthenticated remote attacker can repeatedly send UDP packets to induce a DoS state, and device reset is required for recovery; CVSS v4.0 vectors indicate network-reachable, low-complexity attacks with high availability impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-191 highlighting Mitsubishi Electric's March 2 security advisory and urging users and administrators to review the notice and apply necessary updates. The alert concerned DoS vulnerabilities affecting MELSEC iQ-F Series Ethernet modules.
On March 3, 2026, CVE records were published for two Mitsubishi Electric MELSEC iQ-F Series DoS vulnerabilities: CVE-2026-1874 affecting FX5-ENET/IP and FX5-EIP, and CVE-2026-1875 affecting FX5-EIP. The disclosures included technical classifications, CVSS details, and references to JVN and Mitsubishi Electric PSIRT advisories.
Mitsubishi Electric published a security advisory addressing multiple denial-of-service vulnerabilities in MELSEC iQ-F Series modules, including the FX5-ENET/IP Ethernet Module and FX5-EIP EtherNet/IP Module. The flaws can be triggered remotely by continuously sending UDP packets, and affected devices may require a system reset to recover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcemitsubishielectric.com
Open sourcemitsubishielectric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA republished Mitsubishi Electric advisories for two **high-severity denial-of-service vulnerabilities** affecting industrial control products in the **MELSEC iQ-F Series**. The flaws impact the **FX5-EIP EtherNet/IP Module** (`CVE-2026-8805`) and the **FX5-ENET/IP Ethernet Module** (`CVE-2026-8806`), both used in critical manufacturing environments. In the FX5-EIP module, a remotely reachable integer overflow in the EtherNet/IP function can be triggered by rapidly opening many TCP connections, leading to inconsistent connection handling and improper memory access. In the FX5-ENET/IP module, an expected-behavior violation can be exploited by flooding the Ethernet port with a large volume of packets, overloading processing and stopping communications while disabling internal anomaly-detection processing. CISA and Mitsubishi rated both issues **High** severity, with `CVE-2026-8806` carrying a **CVSS v4.0 score of 8.7** and affecting **all versions** of the FX5-ENET/IP module, while `CVE-2026-8805` affects **version 1.000 and earlier** of the FX5-EIP module. Recommended mitigations include applying vendor fixes where available, minimizing network exposure, isolating control systems behind firewalls, restricting access with segmentation and secure remote connectivity such as updated VPNs, and monitoring for abnormal traffic or excessive connection attempts. The disclosures follow earlier CISA advisories involving Mitsubishi MELSEC networking components, including an authentication-bypass issue in the **WS Series** Ethernet interface module (`CVE-2023-1618`).
Jul 12, 2026
CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric **MELSEC** industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, `CVE-2023-4699`, is a **missing authentication** flaw (`CWE-306`) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it **CVSS 10.0** and said the update expanded the list of affected products and revised mitigations and scoring. A separate advisory covers `CVE-2021-20613`, an **improper initialization** flaw in MELSEC-F Series Ethernet modules including **FX3U-ENET**, **FX3U-ENET-L**, and **FX3U-ENET-P502** running firmware `1.16` or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware `1.17` or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.
Jun 29, 2026
CISA and Mitsubishi Electric disclosed multiple denial-of-service vulnerabilities affecting **MELSEC iQ-R** industrial controllers and related modules used in the critical manufacturing sector. The issues include improper input validation in `CVE-2022-40265`, improper session management in `CVE-2021-20591`, and uncontrolled resource consumption flaws tracked as `CVE-2020-5666` and `CVE-2020-5527`. The vulnerabilities can be exploited remotely in various configurations to disrupt communications, block legitimate client connections, or force affected devices into an unresponsive state that may require a system reset or port recovery. Affected products span MELSEC iQ-R CPU modules, Ethernet interfaces, C Controller modules, and broader MELSEC controller families including **iQ-F, Q, L, and F series** in some cases. Mitsubishi Electric issued firmware updates and mitigations such as disabling unnecessary web server functions, upgrading to fixed firmware, restricting network access with firewalls and IP filtering, and limiting exposure to trusted LAN environments or VPN-protected remote access. CISA also urged operators to isolate control systems from business networks and reduce Internet exposure; at the time of the advisories, no known public exploits were reported as specifically targeting these flaws.
Jun 29, 2026