EUVD-2026-37973
GHSA-hc5r-cmjq-47w9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to OT network segment
-
DeliveryIdentify FX5-EIP EtherNet/IP listener on TCP/44818
-
ExploitFlood module with rapid TCP connection attempts
-
ExecutionTrigger integer overflow in connection-management counter
-
PersistImproper memory access halts EtherNet/IP function
-
ImpactPLC loses I/O communication and process disrupted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker needs network-layer TCP reachability to the FX5-EIP module's EtherNet/IP listener (the EtherNet/IP function must be enabled, which is the module's primary purpose, so this is effectively the default operating mode) and the ability to rapidly open many TCP connections to it. No authentication, no user interaction, and no special non-default configuration are required (PR:N/UI:N/AC:L/AT:N). Exploitation is LIMITED to firmware versions 1.000 and prior of the FX5-EIP module specifically (other MELSEC iQ-F EtherNet/IP modules are not in scope per the CPE), and in practice by network segmentation - properly air-gapped or firewalled OT networks per ISA/IEC 62443 prevent an outside attacker from reaching the listener, leaving the realistic threat to be an attacker already on the OT LAN. |
| Impact | Signals are consistent and point to a real but bounded risk. CVSS 4.0 8.7 (High) with AV:N/AC:L/AT:N/PR:N/UI:N and VA:H accurately reflects a network-reachable, unauthenticated, low-complexity availability bug with no confidentiality or integrity impact and no subsequent-system impact - the device crashes, but data is not exfiltrated or modified. EPSS and CISA KEV status are not provided in the input, so probability of mass exploitation cannot be quantified, and no public exploit identified at time of analysis. The practical risk is dominated by exposure: FX5-EIP modules should sit on isolated OT networks per ISA/IEC 62443, so internet-exposed instances are the true worst case; on properly segmented plant networks the attacker must already be on the OT LAN, which reduces but does not eliminate risk (insider, compromised engineering workstation, or flat IT/OT network). Availability impact on a PLC communication module can translate directly to process disruption, so this should be prioritized above a typical IT DoS even without KEV listing. |
| Exploit ScenarioDerived | An attacker with network reachability to a plant's OT segment - for example, via a compromised engineering workstation, a flat IT/OT network, or an exposed remote-access gateway - scripts a tool such as a tweaked hping3, masscan, or custom Python socket loop to open TCP connections to the FX5-EIP module's EtherNet/IP port (TCP/44818) as fast as the network allows. Within seconds the module's connection counter overflows and improper memory access halts EtherNet/IP communication, causing the PLC to lose its EtherNet/IP I/O and potentially driving the controlled process into a fault or safe-state. No public exploit identified at time of analysis, but the technique is trivial to reproduce given the AV:N/AC:L profile. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 19, 2026
Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module (versions 1.000 and prior) allows a remote unauthenticated attacker to crash the device by rapidly opening many TCP connections, which trips an integer overflow in the EtherNet/IP connection-management logic and triggers improper memory access. No public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and high availability impact make this a meaningful operational-technology (OT) concern for plants relying on the affected PLC module. Reported by the vendor and tracked in vendor PSIRT advisory 2026-002, JVN VU#97140216, and CISA ICS advisory ICSA-26-169-05.
RemediationAI
Patch status: Patch available per vendor advisory - consult Mitsubishi Electric PSIRT bulletin 2026-002 (https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-002_en.pdf) for the fixed firmware version applicable to your FX5-EIP module and follow the vendor's documented update procedure during a planned maintenance window, since flashing OT firmware typically requires a controlled stop of the controlled process. Until the firmware update is applied, restrict EtherNet/IP traffic (TCP/44818, UDP/2222) to the module to only authorized engineering and SCADA hosts via L3 ACLs or an OT firewall, place FX5-EIP modules behind a properly segmented control network as recommended by CISA ICSA-26-169-05 and ISA/IEC 62443, and consider rate-limiting new TCP connections to the module at the upstream switch/firewall to blunt the connection-flood trigger - note that aggressive rate-limiting can interfere with legitimate scanner/HMI polling and CIP class 3 connection churn, so test thresholds against your normal traffic profile. Also disable any unused EtherNet/IP services on the module if your application does not require them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The FX5-EIP is an EtherNet/IP communication add-on module for Mitsubishi's MELSEC iQ-F series compact programmable logic controllers, used to bridge PLC I/O to EtherNet/IP-based industrial networks (CIP over TCP/UDP, typically TCP/44818 and UDP/2222). The root cause class is CWE-190 (Integer Overflow or Wraparound): a counter or size variable in the module's TCP/EtherNet/IP connection-tracking code wraps when an attacker opens connections faster than the firmware reclaims them, leaving the internal connection table in an inconsistent state and producing an out-of-bounds or otherwise improper memory access that halts the module. The CPE confirms a single affected product line (mitsubishi_electric_melsec_iq-f_series_fx5-eip_ethernet/ip_module_fx5-eip), and the 'Buffer Overflow' tag alongside the CWE-190 classification is consistent with an integer-overflow-leading-to-memory-corruption pattern rather than a pure logic DoS.
Know when Mitsubishi Electric Melsec Iq F Series Fx5 Eip Ethernet Ip Module Fx5 Eip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated TCP flood with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected on the module itself (C:N/I:N/A:H, S:U).
Primary rating from Vendor (Mitsubishi).
CVSS VectorVendor: Mitsubishi
DescriptionCVE.org
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
Executive ViewAI
Mitsubishi Electric MELSEC iQ-F Series FX5-EIP PLC modules (firmware v1.000 and prior) are vulnerable to remote, unauthenticated denial-of-service attacks that crash the device through connection exhaustion, creating direct operational disruption risk for manufacturing and industrial control systems. Any networked attacker can trigger a system outage without credentials, affecting production availability at facilities relying on these devices.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict EtherNet/IP traffic to trusted control networks via firewall ACLs or VLAN boundaries; (2) Connection rate limiting-configure managed switches to throttle inbound TCP connections to affected devices; (3) Access control-whitelist only authorized engineering and HMI workstations; (4) Network monitoring-deploy IDS signatures to detect abnormal connection patterns; (5) Operational resilience-verify failover procedures and alternative production pathways are functional.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Exploit-DB