Which versions of MELSEC iQ-F FX5-EIP are affected by CVE-2026-8805?

Mitsubishi Electric MELSEC iQ-F Series FX5-EIP PLC modules (firmware v1.000 and prior) are vulnerable to remote, unauthenticated denial-of-service attacks that crash the device through connection…

How to fix or mitigate CVE-2026-8805?

Within 24 hours: inventory all Mitsubishi Electric MELSEC iQ-F FX5-EIP modules in production and document current firmware versions; confirm exposure by identifying devices with EtherNet/IP connectivity. Within 7 days: implement network segmentation to restrict EtherNet/IP access to trusted control networks only using firewall rules or VLAN isolation; enable connection rate limiting on managed network infrastructure. Within 30 days: monitor Mitsubishi Electric PSIRT advisory 2026-002 and JVN VU#97140216 for patch release; schedule firmware upgrade to patched version immediately upon vendor release.

MELSEC iQ-F FX5-EIP CVE-2026-8805

Q: What is the CVSS score of CVE-2026-8805?

CVE-2026-8805 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37973 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-19 Mitsubishi

GHSA-hc5r-cmjq-47w9

Integer Overflow Buffer Overflow Mitsubishi Electric Melsec Iq F Series Fx5 Eip Ethernet Ip Module Fx5 Eip

8.7

CVSS 4.0 · Vendor: Mitsubishi

Severity by source

Vendor (Mitsubishi) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated TCP flood with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected on the module itself (C:N/I:N/A:H, S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mitsubishi).

CVSS VectorVendor: Mitsubishi

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 03:15 vuln.today

DescriptionCVE.org

Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.

AnalysisAI

Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module (versions 1.000 and prior) allows a remote unauthenticated attacker to crash the device by rapidly opening many TCP connections, which trips an integer overflow in the EtherNet/IP connection-management logic and triggers improper memory access. No public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and high availability impact make this a meaningful operational-technology (OT) concern for plants relying on the affected PLC module. Reported by the vendor and tracked in vendor PSIRT advisory 2026-002, JVN VU#97140216, and CISA ICS advisory ICSA-26-169-05.

Technical ContextAI

The FX5-EIP is an EtherNet/IP communication add-on module for Mitsubishi's MELSEC iQ-F series compact programmable logic controllers, used to bridge PLC I/O to EtherNet/IP-based industrial networks (CIP over TCP/UDP, typically TCP/44818 and UDP/2222). The root cause class is CWE-190 (Integer Overflow or Wraparound): a counter or size variable in the module's TCP/EtherNet/IP connection-tracking code wraps when an attacker opens connections faster than the firmware reclaims them, leaving the internal connection table in an inconsistent state and producing an out-of-bounds or otherwise improper memory access that halts the module. The CPE confirms a single affected product line (mitsubishi_electric_melsec_iq-f_series_fx5-eip_ethernet/ip_module_fx5-eip), and the 'Buffer Overflow' tag alongside the CWE-190 classification is consistent with an integer-overflow-leading-to-memory-corruption pattern rather than a pure logic DoS.

RemediationAI

Patch status: Patch available per vendor advisory - consult Mitsubishi Electric PSIRT bulletin 2026-002 (https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-002_en.pdf) for the fixed firmware version applicable to your FX5-EIP module and follow the vendor's documented update procedure during a planned maintenance window, since flashing OT firmware typically requires a controlled stop of the controlled process. Until the firmware update is applied, restrict EtherNet/IP traffic (TCP/44818, UDP/2222) to the module to only authorized engineering and SCADA hosts via L3 ACLs or an OT firewall, place FX5-EIP modules behind a properly segmented control network as recommended by CISA ICSA-26-169-05 and ISA/IEC 62443, and consider rate-limiting new TCP connections to the module at the upstream switch/firewall to blunt the connection-flood trigger - note that aggressive rate-limiting can interfere with legitimate scanner/HMI polling and CIP class 3 connection churn, so test thresholds against your normal traffic profile. Also disable any unused EtherNet/IP services on the module if your application does not require them.