CISA republishes Mitsubishi Electric advisory on CC-Link IE TSN flaw

CISA republished a Mitsubishi Electric advisory on a CC-Link IE TSN vulnerability that could let an attacker tamper with control data or trigger a denial-of-service condition.

CISA on 2026-07-30 republished Mitsubishi Electric advisory 2026-005 covering CVE-2026-13584, a flaw in the CC-Link IE TSN communication protocol used across a wide set of Mitsubishi Electric industrial products.

The advisory says the issue could matter for factories and other industrial sites because an attacker on the same network segment, sending specially crafted packets under specific timing conditions, could alter communication data tied to control input and output values. CISA says the same flaw could also interfere with a product’s control function or cause incorrect operation, leading to a denial-of-service condition.

CISA lists the vulnerability as a CWE-924 issue, or improper enforcement of message integrity during transmission in a communication channel. It assigns the problem a CVSS v3.1 base score of 7.1, rated high, and a CVSS v4.0 base score of 7.1, also rated high.

The advisory identifies a large set of affected Mitsubishi Electric products, including MELSEC MX controllers, modules, boards, servo products, inverters, industrial computers, GOT3000 series units, software packages, LSIs and other CC-Link IE TSN-related components. CISA marks the product status as known affected and the remediation status as no fix planned.

According to the advisory, the products are deployed worldwide, Mitsubishi Electric is headquartered in Japan, and the affected sector is Critical Manufacturing.

Mitsubishi Electric recommends restricting physical access to affected products and the CC-Link IE TSN network, managing access to and from the site, locking control panels and Ethernet ports, using the products only within trusted networks where untrusted communication is blocked by a firewall or similar measures, and configuring credentials and access privileges for boundary network devices.

CISA also points readers to general defensive guidance for control system networks. The vulnerability was reported to Mitsubishi Electric by Alessandro Di Pinto, Giovanni Dini Gentilini, Luca Cremona and Gabriele Quagliarella of Nozomi Networks, Inc.

Operators of affected systems are being advised to apply the recommended network and access controls while Mitsubishi Electric keeps the issue listed as having no fix planned.

Sources

• CISA Cybersecurity Advisories — ICSA-26-211-07

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.