Mitsubishi MELSEC iQ-F Series DoS Vulnerability (CISA ICSA-26-169-05)

Vulnerability Overview Vulnerability Name: Mitsubishi Electric MELSEC iQ-F Series Publication Date: June 18, 2026 Alert Code: ICSA-26-169-05 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems CVSS Score: v3.7.5 Vendor: Mitsubishi Electric Device: Mitsubishi Electric MELSEC iQ-F Series Vulnerability Type: Integer Overflow or Wraparound Scope of Impact Critical Infrastructure Sector: Critical Manufacturing Deployed Countries/Regions: Global Company Headquarters Location: Japan Affected Versions: MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP <=1.000 Remediation Recommended Practices: - Take defensive measures to minimize the risk of exploitation of these vulnerabilities. - Minimize the network exposure of all control system equipment and/or systems, and ensure they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure remote access methods, such as Virtual Private Networks (VPNs), when remote access is required; be aware that VPNs may have vulnerabilities and should be updated to the latest version. - Recognize that VPNs are only secure to the extent of the connected devices. - Conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity policies to actively defend ICS assets. - Follow internal procedures to report suspicious malicious activity to CISA. Additional Information Background: Successful exploitation of this vulnerability could allow a remote attacker to cause a denial of service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections, leading to inconsistencies in the product's internal connection management process and triggering improper memory access. Confirmation: Mitsubishi Electric reported this vulnerability to CISA. Legal Notice and Terms of Use: The product is subject to the terms of this notice and the Privacy and Use Policy. Advisory Practices: Provides detailed cybersecurity best practices and recommended measures, including industrial control system cybersecurity and defense-in-depth strategies. Translation Disclaimer: This ICSA is a direct translation of Mitsubishi Electric 2026-002, intended to increase visibility, but does not guarantee the editorial or technical accuracy of the information. Revision History: Initial publication date is June 18, 2026, marking the initial release and initial CISA mirroring. Tags Industry: Critical Manufacturing Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories AzeoTech DAQFactory AVer PTC cameras Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products Schneider Electric EasyLogic T150 and Saitel DP Feedback We welcome your feedback. We have recently updated our anonymous product survey. Contact Information CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov Footer CISA.gov: Official website of the U.S. Department of Homeland Security About CISA: Budget and Performance, OIG.gov, FOIA Requests, Whistleblower Protection No Fear Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback --- The above is a summary of the key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Mitsubishi MELSEC iQ-F Series DoS Vulnerability (CISA ICSA-26-169-05)