CVE-2026-1874: Mitsubishi MELSEC iQ-F DoS Vulnerability

CVE-2026-1874 Overview

CVE-2026-1874 is a Denial of Service vulnerability affecting Mitsubishi Electric Corporation MELSEC iQ-F Series industrial Ethernet modules. The vulnerability stems from an Always-Incorrect Control Flow Implementation (CWE-670) that allows a remote attacker to cause a denial-of-service condition by continuously sending UDP packets to the affected products. Once exploited, a complete system reset of the affected module is required for recovery, making this particularly disruptive in industrial control system (ICS) environments.

Critical Impact

Remote attackers can disrupt industrial control operations by flooding affected MELSEC iQ-F Series Ethernet modules with UDP traffic, causing system unavailability that requires manual intervention to restore.

Affected Products

• Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module versions 1.106 and prior
• Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module (all versions)

Discovery Timeline

• 2026-03-03 - CVE-2026-1874 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-1874

Vulnerability Analysis

This vulnerability is classified under CWE-670 (Always-Incorrect Control Flow Implementation), indicating a fundamental flaw in how the affected modules handle incoming network traffic. The vulnerability exists in the UDP packet processing logic of both the FX5-ENET/IP and FX5-EIP modules. When these modules receive a continuous stream of specially crafted or high-volume UDP packets, the control flow implementation fails to properly manage resources, leading to a denial-of-service condition.

The network-based attack vector with no authentication required makes this vulnerability particularly concerning in ICS/SCADA environments where these modules may be accessible on operational technology (OT) networks. The impact is limited to availability—confidentiality and integrity remain unaffected—but the requirement for a manual system reset significantly increases the operational impact.

Root Cause

The root cause lies in the Always-Incorrect Control Flow Implementation within the UDP handling routines of the affected Ethernet modules. The firmware fails to implement proper rate limiting, input validation, or resource management when processing incoming UDP traffic. This allows an attacker to overwhelm the module's processing capabilities, causing the device to become unresponsive.

Attack Vector

The attack is conducted remotely over the network without requiring any authentication or user interaction. An attacker with network access to the affected module can initiate the attack by sending a continuous stream of UDP packets to the device. The attack can be executed using common network tools capable of generating UDP traffic floods.

The vulnerability exploitation involves:

1. Identifying a vulnerable MELSEC iQ-F Series Ethernet module on the target network
2. Sending continuous UDP packets to the module's listening ports
3. Sustaining the traffic to maintain the denial-of-service condition
4. The device remains unavailable until an operator performs a manual system reset

No verified proof-of-concept code is currently available. For technical details on the vulnerability mechanism, refer to the CISA ICS Advisory ICSA-26-62-01 and the Mitsubishi Electric Vulnerability Report.

Detection Methods for CVE-2026-1874

Indicators of Compromise

• Unusual volumes of UDP traffic directed at MELSEC iQ-F Series Ethernet modules
• FX5-ENET/IP or FX5-EIP modules becoming unresponsive or dropping offline unexpectedly
• Network logs showing sustained UDP packet floods from single or multiple source IPs
• Repeated manual system resets required for affected modules

Detection Strategies

• Deploy network intrusion detection systems (IDS) with rules to identify UDP flood patterns targeting industrial Ethernet module ports
• Configure SNMP monitoring to alert when MELSEC modules stop responding to health checks
• Implement network flow analysis to detect anomalous UDP traffic volumes to OT network segments
• Monitor PLC/module availability metrics for unexpected communication interruptions

Monitoring Recommendations

• Enable detailed logging on firewalls and network devices segmenting OT environments
• Set up automated alerts for UDP traffic exceeding baseline thresholds to industrial Ethernet modules
• Implement continuous availability monitoring for all MELSEC iQ-F Series modules in production environments
• Review network traffic patterns regularly for signs of reconnaissance or flood attempts

How to Mitigate CVE-2026-1874

Immediate Actions Required

• Restrict network access to affected MELSEC iQ-F Series Ethernet modules using firewalls and access control lists
• Implement network segmentation to isolate OT networks from untrusted networks
• Deploy rate limiting on network devices to prevent UDP flood attacks
• Review and restrict remote access to ICS/SCADA environments

Patch Information

Mitsubishi Electric has published a security advisory addressing this vulnerability. For the FX5-ENET/IP module, update to firmware versions later than 1.106 when available. For the FX5-EIP module, all versions are currently affected; refer to the Mitsubishi Electric Vulnerability Report for the latest patch availability and workaround guidance. Additional guidance is available from CISA ICS Advisory ICSA-26-62-01 and the JVN Security Advisory.

Workarounds

• Place affected modules behind firewalls that restrict UDP traffic to only necessary communications
• Implement network access control to allow only authorized devices and users to communicate with affected modules
• Consider deploying industrial-grade intrusion prevention systems (IPS) capable of blocking UDP flood attacks
• Where possible, disable unnecessary network services on affected modules to reduce attack surface

# Example firewall rule to restrict UDP access to MELSEC modules
# Adjust IP ranges and ports according to your environment
iptables -A INPUT -p udp -d <MELSEC_MODULE_IP> -s <TRUSTED_NETWORK> -j ACCEPT
iptables -A INPUT -p udp -d <MELSEC_MODULE_IP> -j DROP