# Mitsubishi MELSEC iQ-F Ethernet modules vulnerable to DoS

Published: 2026-04-08 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/14aca271-c4d4-5fc3-94b0-fcfa2cb7895b/mitsubishi-melsec-iq-f-ethernet-modules-vulnerable-to-dos

> Remote denial-of-service flaw in Mitsubishi MELSEC iQ-F Ethernet modules via malformed SLMP packets; no active exploitation yet.

Mitsubishi Electric has issued an advisory for a denial-of-service vulnerability (CVE-2024-8403) affecting MELSEC iQ-F Series Ethernet modules used in industrial control systems. The vulnerability stems from improper validation of input in the MELSEC iQ-F FX5-ENET (versions 1.100–1.200) and FX5-ENET/IP (versions 1.100–1.104) modules. A remote attacker can craft malformed SLMP (Seamless Message Protocol) packets to cause Ethernet communication to fail on the affected module, requiring a system reset for recovery.

Mitsubishi has released patched firmware versions 1.210 or later for FX5-ENET and 1.106 or later for FX5-ENET/IP. Organizations using these modules in industrial environments should prioritize patching. CISA reports no known public exploitation as of the advisory date, but recommends immediate network segmentation, firewall blocking of untrusted hosts, and IP filtering to restrict access to these modules. The vulnerability is classified as improper input validation (CWE-1287).

## Mentioned in this report

- Vulnerabilities: CVE-2024-8403

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/14aca271-c4d4-5fc3-94b0-fcfa2cb7895b/mitsubishi-melsec-iq-f-ethernet-modules-vulnerable-to-dos.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup