Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A) (CVE-2026-13584)
A message integrity flaw in Mitsubishi Electric CC-Link IE TSN protocol allows network-adjacent attackers to tamper with control data, causing DoS or incorrect operation in critical manufacturing devices. CVE-2026-13584 is a high-severity improper message integrity enforcement vulnerability in the Mitsubishi Electric CC-Link IE TSN communication protocol. An attacker on the same network segment can send crafted packets under specific timing conditions to tamper with control I/O values, causing denial-of-service or incorrect operation of affected industrial control devices.
Detection / Hunteropenrouter
Immediate Actions
- Restrict physical access to affected products and network devices using port locks and locked control panels
- Isolate CC-Link IE TSN networks from untrusted networks using firewalls
- Configure boundary network device credentials and access privileges appropriately
- Block all internet access to CC-Link IE TSN network segments
Key Takeaways
- CVSS v3.1 score is 7.1 (High) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Over 100 distinct Mitsubishi Electric industrial devices and software versions are affected across all version ranges
- No software fix is planned; mitigation relies on physical access restrictions and network segmentation
- Nozomi Networks researchers discovered and reported the vulnerability to Mitsubishi Electric
- CWE-924 categorizes the flaw as improper enforcement of message integrity during transmission
Attack Chain
- Reconnaissance: Attacker identifies Mitsubishi Electric CC-Link IE TSN devices on the same network segment
- Exploit: Attacker sends specially crafted packets under specific timing conditions to tamper with communication data
- Impact: Tampering with control I/O values interferes with device control functions
- Impact: Affected devices experience denial-of-service or operate incorrectly
Affected Systems
- Mitsubishi Electric MELSEC MX Controller MX-R and MX-F models
- Mitsubishi Electric Master/local modules (RJ71GN11, FX5-CCLGN-MS)
- Mitsubishi Electric Motion modules (RD78G, FX5-40SSC-G, LD78G)
- Mitsubishi Electric Block-type remote modules (NZ2GN, NZ2GNS)
- Mitsubishi Electric AC Servo MELSERVO-J5 and JET series
- Mitsubishi Electric GOT3000 Series HMIs
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-13584 | Mitsubishi Electric CC-Link IE TSN Communication Protocol | High | Improper message integrity allows network-adjacent attackers to tamper with communication data and cause DoS. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Vulnerability targets ICS network protocols on OT devices where EDR agents are typically absent. |
| Network Visibility | Medium | Network monitoring can detect crafted CC-Link IE TSN packets but requires protocol-specific inspection capabilities. |
| Detection Difficulty | Hard | Requires protocol-aware network monitoring capable of inspecting CC-Link IE TSN traffic for anomalous timing and integrity violations. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Detect anomalous CC-Link IE TSN packets on the network that attempt to modify control I/O values under specific timing conditions (T0890). | Network traffic analysis and OT protocol-aware IDS alerts | Execution | Medium — legitimate protocol traffic may trigger alerts during normal operations |
| Identify unexpected devices on the CC-Link IE TSN network segment sending control data modification packets (T0886). | Network flow data and switch MAC tables | Initial Access | Low — new devices on segmented OT networks are uncommon |
Required Log Sources
- ICS firewall logs
- Network traffic analysis (PCAP)
- OT protocol-aware IDS/IPS
- Switch port traffic logs
Key Behavioral Indicators
- Anomalous CC-Link IE TSN packets from unauthorized network hosts
- Unexpected timing patterns in CC-Link IE TSN communication
- Control I/O value changes without corresponding legitimate controller commands
- New MAC addresses appearing on CC-Link IE TSN network segments
Control Gaps
- Standard IT network IDS lacks CC-Link IE TSN protocol parsing
- EDR agents not deployed on ICS devices
- Network segmentation between trusted and untrusted zones may be insufficient
False Positive Assessment
Medium — Detecting crafted CC-Link IE TSN packets requires protocol-aware inspection; legitimate traffic variations during normal operations may generate false positives without precise tuning.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement strict network segmentation between OT and business networks
- Deploy OT-aware firewalls capable of deep packet inspection for CC-Link IE TSN
- Use VPNs for remote access with most recent versions and proper configuration
- Monitor CC-Link IE TSN network segments for unauthorized devices and traffic
User Protection
- Restrict physical access to areas where affected products are installed
- Lock control panels housing affected products and network devices
- Use port lock accessories on Ethernet ports of affected devices
- Manage site access to minimize exposure of ICS networks
MITRE ATT&CK Mapping
Plain-Language Summary
A security flaw in Mitsubishi Electric's CC-Link IE TSN communication protocol lets attackers on the same network tamper with data sent between industrial devices. By sending specially timed packets, an attacker could disrupt control functions or cause equipment to operate incorrectly, leading to a denial-of-service condition. Organizations using affected Mitsubishi Electric controllers, modules, or servo systems should restrict physical and network access to these devices and follow the vendor's mitigation guidance.
- cveCVE-2026-13584Improper message integrity allows network-adjacent attackers to tamper with communication data and cause DoS.