Mitsubishi MELSEC Ethernet module DoS flaw unfixable
A DoS vulnerability in Mitsubishi Electric's MELSEC iQ-F FX5-ENET/IP Ethernet Module allows remote attackers to crash communications via packet flooding, with no fix planned.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Mitsubishi Electric has disclosed CVE-2026-8806, an Expected Behavior Violation vulnerability in the MELSEC iQ-F Series FX5-ENET/IP Ethernet Module affecting all versions. A remote attacker can trigger a denial-of-service condition by flooding the Ethernet port with a large volume of packets in a short timeframe, overloading the module's processing capacity and preventing internal anomaly-detection mechanisms from functioning, ultimately causing the communication function to stop.
Notably, Mitsubishi Electric has announced no plans to release a fix for this vulnerability. Instead, the vendor recommends compensating controls including network segmentation (restricting the module to LAN-only operation), deploying firewalls and VPNs to block unauthorized access, using the module's built-in IP filter function to whitelist trusted hosts, restricting physical access to affected systems, and installing anti-virus software on connected PCs.
This advisory affects critical manufacturing environments worldwide where the FX5-ENET/IP module is deployed. Organizations using this hardware must rely entirely on defense-in-depth measures to mitigate the risk, as no patch will be forthcoming.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-06
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs