CVE-2026-8806

Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module

Published Jun 19, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being performed, and causing the communication function to stop.

Analysis

Technical impact

The vulnerability allows a remote attacker to trigger a DoS by sending a large burst of packets to the FX5-ENET/IP Ethernet port, overwhelming the device’s processing resources. This saturation prevents the internal anomaly‑detection mechanisms from operating and ultimately halts all communication functions. The weakness is a failure to enforce proper resource limits during external traffic handling (CWE‑440).

Affected Systems

Mitsubishi Electric MELSEC iQ‑F Series FX5‑ENET/IP Ethernet Module, all released versions, used in industrial control systems.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack vector is remote network access; an attacker only needs to be able to reach the Ethernet interface. No public exploits are documented, but the DoS impact could disrupt critical processes if the device serves as a key controller or network gateway.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mitsubishi Electric Corporation

Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP

unaffected

Version	Status	Constraints
`All versions`	affected	—

No data.

Vendor Product Versions

Mitsubishi Electric Corporation

Melsec Iq-f Series Fx5-enet/ip Ethernet Module Fx5-enet/ip

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply Mitsubishi Electric PSIRT‑recommended firmware update for the FX5‑ENET/IP Ethernet module.
Configure network firewall or access control lists to restrict the volume of traffic allowed to reach the device’s Ethernet port.
Implement rate‑limiting or MAC‑based filtering on the Ethernet interface to mitigate flooding attempts.

Generated by OpenCVE AI on June 19, 2026 at 04:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.637% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://jvn.jp/vu/JVNVU97140216/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-06
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-003_en.pdf

History

Jun 24, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mitsubishi Electric Corporation Mitsubishi Electric Corporation melsec Iq-f Series Fx5-enet/ip Ethernet Module Fx5-enet/ip
Vendors & Products		Mitsubishi Electric Corporation Mitsubishi Electric Corporation melsec Iq-f Series Fx5-enet/ip Ethernet Module Fx5-enet/ip

Jun 22, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 19, 2026 3:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being performed, and causing the communication function to stop.
Title		Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module
Weaknesses		CWE-440
References		https://jvn.jp/vu/JVNVU97140216/ https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-06 https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-003_en.pdf
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`