Advisories › Mitsubishi Electric › ICSA-26-211-07
Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A): 1 CVE, High 7.1
Summary
CISA reports 1 vulnerability in Mitsubishi Electric Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64, Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-128 and 116 more. Weakness type: Improper Enforcement of Message Integrity During Transmission in a Communication Channel. Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. Highest CVSS v3 score: 7.1 (High), exploitable from an adjacent network.
What to do: Prioritize: For customers of the affected products, Mitsubishi Electric recommends restricting physical access to the affected products and the CC-Link IE TSN network to which the affected products are connected by taking measures such as the… The vendor lists no fix for some issues, so lean on mitigations.
Why this matters for oil & gas: Mitsubishi Electric PLCs/ICONICS SCADA are used in some oil & gas facilities.
At a glance
- Vendor
- Mitsubishi Electric
- Products
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64, Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-128, Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-256, Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-N32, Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-P32, Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-16-N32
- CVEs
- CVE-2026-13584
- Highest CVSS v3
- 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Japan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-13584 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | 7.1 | – | No | Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CWE-924) vulnerability exists in the CC-Link IE TSN communication protocol. This vulnerability could allow an attacker with access to the same network segment to tamper with communication data, such as control input and output values, by sending specially crafted packets under specific timing conditions. This… |
Affected products (120)
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-128: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-256: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-N32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-P32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-16-N32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-16-P32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-N32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-P32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-8-N32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-8-P32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-16-N32: vers:all/*
- Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-16-P32: vers:all/*
- Mitsubishi Electric Master/local module RJ71GN11-T2: vers:all/*
- Mitsubishi Electric Master/local module RJ71GN11-SX: vers:all/*
- Mitsubishi Electric Master/local module RJ71GN11-EIP: vers:all/*
- Mitsubishi Electric Master/local module FX5-CCLGN-MS: vers:all/*
- Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-SX: vers:all/*
- Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-T2: vers:all/*
- Mitsubishi Electric Motion module RD78G4: vers:all/*
- Mitsubishi Electric Motion module RD78G8: vers:all/*
- Mitsubishi Electric Motion module RD78G16: vers:all/*
- Mitsubishi Electric Motion module RD78G64: vers:all/*
- Mitsubishi Electric Motion module RD78GHV: vers:all/*
- Mitsubishi Electric Motion module RD78GHW: vers:all/*
- Mitsubishi Electric Motion module FX5-40SSC-G: vers:all/*
- Mitsubishi Electric Motion module FX5-80SSC-G: vers:all/*
- Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G4: vers:all/*
- Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G16: vers:all/*
- Mitsubishi Electric Motion Control Board MR-EM441G: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32TE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32DT: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32DTE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32TE: vers:all/*
Show 80 more
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32DT: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32DTE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GNCF1-32D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GNCF1-32T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GNCE3-32D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GNCE3-32DT: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A4-16D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A4-16DE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A2-16T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A2-16TE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A42-16DT: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN12A42-16DTE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16TE: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16D: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16T: vers:all/*
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16TE: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D-K: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE-K: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE-K: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-14DT: vers:all/*
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-16DTE: vers:all/*
- Mitsubishi Electric Analog-Digital converter module NZ2GN2S-60AD4: vers:all/*
- Mitsubishi Electric Analog-Digital converter module NZ2GN2B-60AD4: vers:all/*
- Mitsubishi Electric Digital-Analog converter module NZ2GN2S-60DA4: vers:all/*
- Mitsubishi Electric Digital-Analog converter module NZ2GN2B-60DA4: vers:all/*
- Mitsubishi Electric CC-Link IE TSN compatible coupler NZ2FT-GN: vers:all/*
- Mitsubishi Electric FPGA module NZ2GN2S-D41P01: vers:all/*
- Mitsubishi Electric FPGA module NZ2GN2S-D41D01: vers:all/*
- Mitsubishi Electric FPGA module NZ2GN2S-D41PD02: vers:all/*
- Mitsubishi Electric Tension meter LM7-1LG: vers:all/*
- Mitsubishi Electric Tension meter LM7-2LG: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5-G: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5W-G: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5-G-HS: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5-G-RJ: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5-G-LL: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-J5D-G4 : vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-J5 MR-MD333G: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-JET MR-JET-G: vers:all/*
- Mitsubishi Electric AC Servo MELSERVO-JET MR-JET-G4-HS: vers:all/*
- Mitsubishi Electric Liner Track System MTR-S series Linear track control module MTR-SCU00-4G: vers:all/*
- Mitsubishi Electric Liner Track System MTR-S series Linear track control module MTR-SCU00-PG: vers:all/*
- Mitsubishi Electric Inverter FR-A800/F800/E800 Series FR-A8NCG: vers:all/*
- Mitsubishi Electric Inverter FR-A800/F800/E800 Series FR-A8NCG-S: vers:all/*
- Mitsubishi Electric Inverter FR-A800/F800/E800 Series FR-A800-GN: vers:all/*
- Mitsubishi Electric Inverter FR-A800/F800/E800 Series FR-E800-E: vers:all/*
- Mitsubishi Electric Inverter FR-A800/F800/E800 Series FR-E800-SCE: vers:all/*
- Mitsubishi Electric Industrial Robot CR800-D series controller Network Base Card 2F-DQ535-TSN: vers:all/*
- Mitsubishi Electric CC-Link IE TSN expansion unit FCU8-EX569: vers:all/*
- Mitsubishi Electric CC-Link IE TSN-CC-Link IE Field Network bridge module NZ2GN-GFB: vers:all/*
- Mitsubishi Electric CC-Link IE TSN-AnyWireASLINK bridge module NZ2AW1GNAL: vers:all/*
- Mitsubishi Electric Energy Measuring Unit CC-Link IE TSN Communication Unit EMU4-CM-TSN: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3715-FHCBD: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3712-WXCBD: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3715-XRBA: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3715-XRBD: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3712-XRBA: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3712-XRBD: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3710-XRBA: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3710-XRBD: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3708-XRBA: vers:all/*
- Mitsubishi Electric GOT3000 Series GT3708-XRBD: vers:all/*
- Mitsubishi Electric CC-Link IE TSN Communication Unit GT25-J71GN13-T2: vers:all/*
- Mitsubishi Electric Motion Control Software SWM-G: vers:all/*
- Mitsubishi Electric Motion Control Software SWM-G-N1: vers:all/*
- Mitsubishi Electric CC-Link IE TSN Communication Software for Windows SW1DND-CCIETCT-M: vers:all/*
- Mitsubishi Electric Analysis Support Software MELSOFT VIMA SW1DNN-VIMA-M: vers:all/*
- Mitsubishi Electric Master/Local module Designated communication LSI DeviceKit NZ2KT-NPETNG51: vers:all/*
- Mitsubishi Electric Remote Station Communication LSI with GbE-PHY NZ2GACP620-60: vers:all/*
- Mitsubishi Electric Remote Station Communication LSI with GbE-PHY NZ2GACP620-300: vers:all/*
- Mitsubishi Electric Remote Station Communication LSI with GbE-PHY NZ2GACP621-90: vers:all/*
- Mitsubishi Electric Remote Station Communication LSI with GbE-PHY NZ2GACP621-720: vers:all/*
- Mitsubishi Electric CC-Link IE TSN Master/Local module Designated communication LSI SDK SW1DNN-GN610SRC-M: vers:all/*
- Mitsubishi Electric Remote station software development kit SW1DNC-GNSDK1S-M: vers:all/*
- Mitsubishi Electric Remote station software development kit SW1DNC-GNSDK2S-M: vers:all/*
Vendor fixes and mitigations (from advisory)
- No Fix Planned: For customers using the affected products, please refer to Mitsubishi Electric's security advisory, "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf" and take the measures described there. link
- Mitigation: For customers of the affected products, Mitsubishi Electric recommends restricting physical access to the affected products and the CC-Link IE TSN network to which the affected products are connected by taking measures such as the following: (a) managing access to and from the site where the affected products are installed, (b) locking the control panel in which the affected products and/or the network devices are installed, and (c) locking the Ethernet ports such as with port lock accessories, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers of the affected products, Mitsubishi Electric recommends using the affected products within a trusted network where communication with untrusted networks and hosts is blocked by a firewall or similar measures, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers of the affected products, Mitsubishi Electric recommends appropriately configuring credentials and access privileges for network devices installed at the boundary between trusted networks and external networks, to minimize the risk of exploitation of this vulnerability.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-211-07
- Machine-readable CSAF record
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.