Skip to main content

MELSEC iQ-F FX5-EIP CVE-2026-8805

| EUVDEUVD-2026-37973 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-06-19 Mitsubishi GHSA-hc5r-cmjq-47w9
Buffer Overflow Integer Overflow Mitsubishi Electric Melsec Iq F Series Fx5 Eip Ethernet Ip Module Fx5 Eip
8.7
CVSS 4.0 · Vendor: Mitsubishi
Share

Severity by source

Vendor (Mitsubishi) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote unauthenticated TCP flood with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected on the module itself (C:N/I:N/A:H, S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mitsubishi).

CVSS VectorVendor: Mitsubishi

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 19, 2026 - 03:15 vuln.today

DescriptionCVE.org

Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.

AnalysisAI

Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module (versions 1.000 and prior) allows a remote unauthenticated attacker to crash the device by rapidly opening many TCP connections, which trips an integer overflow in the EtherNet/IP connection-management logic and triggers improper memory access. No public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and high availability impact make this a meaningful operational-technology (OT) concern for plants relying on the affected PLC module. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain access to OT network segment
Delivery
Identify FX5-EIP EtherNet/IP listener on TCP/44818
Exploit
Flood module with rapid TCP connection attempts
Execution
Trigger integer overflow in connection-management counter
Persist
Improper memory access halts EtherNet/IP function
Impact
PLC loses I/O communication and process disrupted
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Attacker needs network-layer TCP reachability to the FX5-EIP module's EtherNet/IP listener (the EtherNet/IP function must be enabled, which is the module's primary purpose, so this is effectively the default operating mode) and the ability to rapidly open many TCP connections to it. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent and point to a real but bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network reachability to a plant's OT segment - for example, via a compromised engineering workstation, a flat IT/OT network, or an exposed remote-access gateway - scripts a tool such as a tweaked hping3, masscan, or custom Python socket loop to open TCP connections to the FX5-EIP module's EtherNet/IP port (TCP/44818) as fast as the network allows. Within seconds the module's connection counter overflows and improper memory access halts EtherNet/IP communication, causing the PLC to lose its EtherNet/IP I/O and potentially driving the controlled process into a fault or safe-state. …
Remediation Patch status: Patch available per vendor advisory - consult Mitsubishi Electric PSIRT bulletin 2026-002 (https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-002_en.pdf) for the fixed firmware version applicable to your FX5-EIP module and follow the vendor's documented update procedure during a planned maintenance window, since flashing OT firmware typically requires a controlled stop of the controlled process. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Mitsubishi Electric MELSEC iQ-F FX5-EIP modules in production and document current firmware versions; confirm exposure by identifying devices with EtherNet/IP connectivity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2015-8651 HIGH
8.8
CVE-2025-48595 HIGH POC
8.4
CVE-2026-21385 HIGH POC
7.8
CVE-2025-46817 HIGH POC
7.0
CVE-2025-53518 CRITICAL POC
9.8
CVE-2025-6021 HIGH POC
7.5
CVE-2025-46819 MEDIUM POC
6.3
CVE-2026-27809 CRITICAL POC
9.1

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-8805 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy