CVE-2026-1874 in MELSEC iQ-F FX5-ENET IP Ethernet Module FX5-ENET
Summary
by MITRE • 03/03/2026
Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The CVE-2026-1874 vulnerability represents a critical control flow implementation flaw affecting Mitsubishi Electric Corporation's MELSEC iQ-F Series industrial automation products. This vulnerability specifically impacts the FX5-ENET/IP Ethernet Module and FX5-EIP EtherNet/IP Module versions, creating a persistent denial-of-service condition that can be triggered remotely through continuous UDP packet flooding. The flaw resides in the improper handling of network traffic within the device's control flow mechanisms, where the system fails to properly validate or manage incoming UDP communications, leading to a complete system failure that requires manual reset for recovery.
This vulnerability manifests as an always-incorrect control flow implementation, which aligns with CWE-754 weakness classification, indicating a defect in the software's logic that allows for predictable and exploitable behavior. The remote exploitation capability means that attackers can initiate this attack from outside the local network, making it particularly dangerous for industrial control systems that may be exposed to external networks. The attack vector specifically targets UDP communication protocols, leveraging the inherent characteristics of these packets to overwhelm the device's processing capabilities and trigger the denial-of-service condition.
The operational impact of this vulnerability extends beyond simple service interruption, as it represents a fundamental flaw in the industrial device's ability to maintain operational continuity. In industrial environments where these devices operate as part of critical control systems, a denial-of-service condition can lead to production halts, safety system failures, and potentially dangerous operational scenarios. The requirement for manual system reset creates additional operational challenges, as it may necessitate on-site intervention during critical operations, potentially leading to extended downtime and increased maintenance costs.
From a cybersecurity perspective, this vulnerability demonstrates the importance of proper input validation and robust error handling in industrial control systems, as outlined in the MITRE ATT&CK framework's defense evasion and resource exhaustion tactics. The vulnerability's classification as a remote attack vector emphasizes the need for network segmentation and proper firewall configurations to limit exposure. Organizations should implement network monitoring to detect unusual UDP traffic patterns and establish automated alerting systems to identify potential exploitation attempts. Additionally, regular firmware updates and security assessments should be conducted to address similar control flow implementation issues that may exist in industrial control systems.
The remediation approach for this vulnerability requires immediate attention through firmware updates provided by Mitsubishi Electric Corporation, as well as network-level protections such as UDP traffic filtering and rate limiting. Implementing network access controls and restricting unnecessary network exposure of these devices can significantly reduce the attack surface. Security teams should also consider implementing intrusion detection systems specifically configured to monitor for UDP flooding patterns and establish incident response procedures that account for the need for manual system resets in industrial environments.