Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module

View CSAF
Summary
Successful exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets to the affected products.
The following versions of Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module are affected:

MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP <=1.106, vers:all/* (CVE-2026-1874, CVE-2026-1876)
MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP vers:all/* (CVE-2026-1874, CVE-2026-1875)





CVSS
Vendor
Equipment
Vulnerabilities




v3 7.5
Mitsubishi Electric
Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module Always-Incorrect Control Flow Implementation, Improper Resource Shutdown or Release




Background

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Japan


Vulnerabilities

Expand All +

CVE-2026-1874

An always-incorrect control flow implementation vulnerability may allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets to the affected products.
View CVE Details

Affected Products
Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module

Vendor:Mitsubishi Electric
Product Version:Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP: <=1.106, Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP: vers:all/*
Product Status:known_affected


Remediations
Vendor fixUsers of FX5-ENET/IP versions 1.106 and prior should download the update file for version 1.107 or later and apply it. The update file is available at: https://www.mitsubishielectric.com/fa/download/index.html.
MitigationThe fixed version for the FX5-EIP is scheduled to be released in the near future. In the meantime, users should apply mitigations or workarounds.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to ?13.1 IP Filter Function? in the MELSEC iQ-F FX5 User?s Manual (Communication).
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.
MitigationFor more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf

Relevant CWE: CWE-670 Always-Incorrect Control Flow Implementation

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2026-1875

An improper resource shutdown or release vulnerability in the affected products may allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets.
View CVE Details

Affected Products
Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module

Vendor:Mitsubishi Electric
Product Version:Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP: vers:all/*
Product Status:known_affected


Remediations
MitigationThe fixed version for the FX5-EIP is scheduled to be released in the near future. In the meantime, users should apply mitigations or workarounds.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to ?13.1 IP Filter Function? in the MELSEC iQ-F FX5 User?s Manual (Communication).
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.
MitigationFor more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf

Relevant CWE: CWE-404 Improper Resource Shutdown or Release

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2026-1876

An improper resource shutdown or release vulnerability may allow a remote attacker to cause a denial-of-service condition in the affected products by continuously sending UDP packets.
View CVE Details

Affected Products
Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module

Vendor:Mitsubishi Electric
Product Version:Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP: vers:all/*
Product Status:known_affected


Remediations
No fix plannedUsers should apply mitigations or workarounds since there are no plans to release a fixed version.
MitigationFor users of products that do not have a fixed version, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to ?13.1 IP Filter Function? in the MELSEC iQ-F FX5 User?s Manual (Communication).
MitigationFor users of products that do not have a fixed version, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.
MitigationFor users of products that do not have a fixed version, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.
MitigationFor more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf

Relevant CWE: CWE-404 Improper Resource Shutdown or Release

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H








Acknowledgments

Mitsubishi Electric reported these vulnerabilities to CISA


Legal Notice and Terms of Use
This product is provided subject to this notification (https://www.cisa.gov/notification) and this privacy & use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer
This ICSA is a republication of Mitsubishi Electric security advisory "2025-021 Multiple denial-of-service vulnerabilities in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module" from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact CISA directly for any questions regarding this advisory.
Revision History

Initial Release Date: 2026-03-03




Date
Revision
Summary




2026-03-03
1
Initial Publication


2026-03-03
2
Initial CISA Republication of Mitsubishi Electric security advisory 2025-021




Legal Notice and Terms of Use

https://www.cisa.gov/news-events/ics-advisories/icsa-26-62-01

2026-03-03 12:00 UTC
--- FMail-lnx 2.3.2.6-B20251227
* Origin: TCOB1 A Mail Only System (2:263/1)