How to Fix CVE-2026-1875: MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-1875 is a sibling vulnerability in the same vendor advisory as CVE-2026-1874. Apply the same patched build and you close both. The technical detail below is what differs.

What's different about CVE-2026-1875?

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.

How to fix CVE-2026-1875

Apply the patched build per the primary write-up: How to Fix CVE-2026-1874. All commands, verification steps, and rollback notes for MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP are listed there.

Frequently asked questions

Does the CVE-2026-1874 patch close CVE-2026-1875?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-1875 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf

References

• Official vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-1875
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary: How to Fix CVE-2026-1874

*Written by Sai Kiran Pandrala. Part of the MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP bundle. Full procedure at how-to-fix-cve-2026-1874.*