Mitsubishi MELSEC iQ-F DoS flaw patched
Mitsubishi Electric patched CVE-2026-8805, an integer overflow in MELSEC iQ-F Series EtherNet/IP modules that allows remote DoS via rapid TCP connection flooding.
Mitsubishi Electric has released a security update for its MELSEC iQ-F Series FX5-EIP EtherNet/IP Module to address CVE-2026-8805, an integer overflow vulnerability in the EtherNet/IP function. A remote attacker can exploit this flaw by rapidly establishing a large number of TCP connections to the affected device, causing an inconsistency in the product's internal connection management process and triggering improper memory access that results in a denial-of-service condition.
The vulnerability affects MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP version 1.000 and earlier. Mitsubishi Electric has released version 1.001 to remediate the issue, available through their official download portal. For organizations unable to immediately apply the patch, the vendor recommends network segmentation, firewall protections, VPN usage, IP filtering, physical access controls, and anti-virus deployment on connected systems.
This vulnerability impacts critical manufacturing facilities worldwide. Organizations using affected modules should prioritize patching or implement compensating controls to minimize exposure from untrusted networks.
Mentioned in this report
Detection guidance
Potential EtherNet/IP TCP Connection Flood Targeting MELSEC iQ-F FX5-EIP Module
Detects a burst of TCP connection attempts to the EtherNet/IP service port (44818) on MELSEC iQ-F FX5-EIP modules, consistent with the CVE-2026-8805 connection-flood DoS technique; this rule flags the traffic pattern and should be paired with a SIEM-side threshold/burst correlation (e.g., >50 new connections from a single source within 10 seconds) since Sigma conditions cannot express counts natively. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential EtherNet/IP TCP Connection Flood Targeting MELSEC iQ-F FX5-EIP Module
id: 0035b24e-3f9d-5228-ae62-ee2fadd4e097
status: experimental
description: 'Identifies TCP connection establishment attempts to the EtherNet/IP
service port (44818) commonly exposed by Mitsubishi MELSEC iQ-F FX5-EIP EtherNet/IP
modules.
CVE-2026-8805 is exploited by rapidly opening a large number of TCP connections
to this port, causing an integer overflow in the device''s connection management
and resulting in denial of service.
Because Sigma conditions cannot express rate/threshold logic, analysts should correlate
this rule with a burst threshold (e.g., a single source IP generating dozens of
connection attempts to this port within a short window, such as 10-30 seconds) in
the SIEM or NDR platform to reduce false positives from normal ICS polling traffic.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498.001
- attack.impact
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 44818
Protocol: tcp
filter_established_ics_polling:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_established_ics_polling
falsepositives:
- Legitimate SCADA/HMI polling or PLC programming software establishing routine EtherNet/IP
sessions from known internal engineering workstations
- Network scanners or asset discovery tools performing authorized vulnerability scans
against ICS segments
- Load-balancers or protocol gateways proxying EtherNet/IP traffic that create many
short-lived connections during normal operation
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-05
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free