This vulnerability (CVE-2026-1874) affects Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and earlier, as well as FX5-EIP EtherNet/IP Module versions 1.000 and earlier. It is classified under CWE-670 (Always-Incorrect Control Flow Implementation). A remote attacker can exploit this by sending continuous UDP packets, causing the device to enter a denial-of-service state that necessitates a system reset to recover. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on availability.

Successful exploitation results in a denial-of-service condition on the affected Mitsubishi Electric Ethernet modules, disrupting their normal operation until a manual system reset is performed. This impacts availability but does not indicate confidentiality or integrity compromise. The vulnerability can be triggered remotely without authentication or user interaction.

No patch or official fix is currently documented for this vulnerability. Users should monitor Mitsubishi Electric's advisories for updates. Until a fix is available, limiting exposure of the affected modules to untrusted networks and controlling UDP traffic to these devices may reduce risk. Affected systems require manual reset after an attack to restore functionality.