A flaw in the Ethernet module of Mitsubishi Electric’s MELSEC iQ‑F Series FX5‑ENET/IP triggers an improper resource shutdown when the device receives a sustained stream of UDP packets. The flaw causes the product to reset, resulting in a denial‑of‑service condition. The weakness is classified as CWE‑404, and based on the description it is inferred that no authentication or local access is required.

All firmware versions of the MELSEC iQ‑F Series FX5‑ENET/IP Ethernet Module FX5‑ENET/IP from Mitsubishi Electric are affected. The vulnerability resides in the Ethernet function and applies to every variant of the module within the series.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in CISA’s catalog of known exploited vulnerabilities. Attackers could exploit this flaw from a remote location by sending crafted UDP packets, forcing the device to reset and disrupting critical industrial control processes. While the preferred mitigation is an official firmware update, temporary network‑level controls such as UDP rate limiting can reduce the impact, though they do not provide a complete fix. Consequently, the risk remains with devices still running affected firmware and exposed to UDP traffic.