Improper resource shutdown or release in the Ethernet function of the MELSEC iQ-F Series FX5-EIP EtherNet/IP Module allows a remote attacker to trigger a DoS condition by persistently sending UDP packets. The vulnerability, classified under CWE‑404, results in the module entering an error state that can only be recovered via a full system reset, effectively making the device unavailable until the reset is performed.

The affected devices are Mitsubishi Electric Corporation’s MELSEC iQ‑F Series FX5‑EIP EtherNet/IP Modules, specifically the FX5‑EIP component, across all released versions. No other vendors or product lines are listed as impacted.

The CVSS score of 8.7 denotes a high severity level, while an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network, requiring continuous UDP traffic directed at the module’s IP address; no authentication or special privileges are required. Because the DoS state requires a manual reset, the impact is interrupted operations and potential business downtime.