CVE-2026-1874

High

Published: 03/03/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric's FX5-ENET/IP and FX5-EIP Ethernet modules allows a remote attacker to cause a denial-of-service (DoS) condition by continuously sending UDP packets. Affected versions are FX5-ENET/IP 1.106 and prior, and FX5-EIP 1.000 and prior.

Risk Assessment

An attacker can render the products unavailable, potentially leading to disruptions in industrial systems. A system reset is required to restore functionality.

Recommendation

It is recommended to update the modules to the latest versions that address this vulnerability. Additionally, implementing monitoring mechanisms for UDP traffic to detect potential attacks is advisable.

Other vulnerabilities in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module, Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module

CVE-2026-8806High
The CVE-2026-8806 vulnerability in the FX5-ENET/IP Ethernet module of Mitsubishi Electric's MELSEC iQ-F series allows a remote attacker to cause a denial-of-service (DoS) condition by continuously sending a large number of communication packets in a short period, leading to product processing overload.

Original NVD description (English source)

Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.