Count the entries and the affected list runs to 43 distinct model numbers [10]. The supplied text breaks off mid-entry on a further MELSEC iQ-F module, so the real count is at least 43 [9].
The breakdown carries the operational weight. Twenty-six CC-Link IE TSN remote I/O modules are listed at firmware 09 and below [4]. Four analog and digital converter modules sit at 07 and below [5]. Three FPGA modules appear at version 01 with no range operator at all [6]. Two CP620 communication LSIs are gated at 1.08J and two CP610 parts at 05 [7]. On the MELSEC iQ-R side, RJ71GN11-T2 is affected through 26, RJ71GN11-EIP through 10, RJ71GN11-SX through 05, and RJ71EN71 through 85 [8]. FX5-CCLGN-MS runs to 1.020 and FX5-ENET to 1.200 [9].
That is ten different version thresholds for one CVE [11]. A fleet rule written as "anything at or below 09" clears the remote I/O population and leaves the 60AD4 converters, the CP620 LSIs at 1.08J, RJ71EN71 at 85, and FX5-ENET at 1.200 sitting under the same defect. The numbering formats are not even comparable to each other: two-digit sequential builds, a letter-suffixed 1.08J, and dotted strings where 1.020 is lower than 1.200. An inventory query has to compare per family, by part number, as text.
The FPGA modules deserve a separate look. They are listed at a single version, 01, rather than a range [6], and the supplied advisory text does not indicate whether a later build exists to move to [13]. That makes it a vendor question first and a change ticket second.
On urgency: the stated impact ceiling is availability. A specially crafted UDP packet can produce a denial of service, a timeout error, or a communication delay on the product [2]. There is no code execution claimed here, and the material at hand carries no CVSS score and no statement that anyone has exploited this in the field [13]. On modules that carry field I/O, a timeout is still a process event, so it earns a scheduled window rather than an unplanned one.
Across four lettered revisions [12] of ICSA-25-128-03 [3], the finding has stayed constant while the affected-version list keeps growing. The mechanism has been the same UDP packet since first publication [2]. Anyone who read the original, checked their masters, and closed the item is holding a diff taken against a shorter inventory than the one CISA is publishing now [1].
