Home / Items
Industrial control advisorySeverity 7.1 high
Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update B)
ICSA-26-211-07 · CISA · July 30, 2026
Summary
Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.
From CISA, quoted as published. Check the source before acting.
What to do
For customers using the affected products, please refer to Mitsubishi Electric's security advisory, "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf" and take the measures described there.
For customers of the affected products, Mitsubishi Electric recommends restricting physical access to the affected products and the CC-Link IE TSN network to which the affected products are connected by taking measures such as the following: (a) managing access to and from the site where the affected products are installed, (b) locking the control panel in which the affected products and/or the network devices are installed, and (c) locking the Ethernet ports such as with port lock accessories, to minimize the risk of exploitation of this vulnerability.
For customers of the affected products, Mitsubishi Electric recommends using the affected products within a trusted network where communication with untrusted networks and hosts is blocked by a firewall or similar measures, to minimize the risk of exploitation of this vulnerability.
For customers of the affected products, Mitsubishi Electric recommends appropriately configuring credentials and access privileges for network devices installed at the boundary between trusted networks and external networks, to minimize the risk of exploitation of this vulnerability.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-13584 | 7.1 high | No | 0.2% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-128 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-256 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-N32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-8-P32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-16-N32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100-16-P32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-N32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-P32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-8-N32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-8-P32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-16-N32 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC MX Controller MX-F model MXF100S-16-P32 |
| Mitsubishi Electric | Mitsubishi Electric Master/local module RJ71GN11-T2 |
| Mitsubishi Electric | Mitsubishi Electric Master/local module RJ71GN11-SX |
| Mitsubishi Electric | Mitsubishi Electric Master/local module RJ71GN11-EIP |
| Mitsubishi Electric | Mitsubishi Electric Master/local module FX5-CCLGN-MS |
| Mitsubishi Electric | Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-SX |
| Mitsubishi Electric | Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-T2 |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78G4 |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78G8 |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78G16 |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78G64 |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78GHV |
| Mitsubishi Electric | Mitsubishi Electric Motion module RD78GHW |
| Mitsubishi Electric | Mitsubishi Electric Motion module FX5-40SSC-G |
| Mitsubishi Electric | Mitsubishi Electric Motion module FX5-80SSC-G |
| Mitsubishi Electric | Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G4 |
| Mitsubishi Electric | Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G16 |
| Mitsubishi Electric | Mitsubishi Electric Motion Control Board MR-EM441G |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2S1-32D |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2S1-32T |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2S1-32TE |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2S1-32DT |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2S1-32DTE |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2B1-32D |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2B1-32T |
| Mitsubishi Electric | Mitsubishi Electric Block-type remote module NZ2GN2B1-32TE |
82 more in the source.
Why it's on these mode pages
- Maritime: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Mitsubishi Electric (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- July 30, 2026: Initial Publication
- July 30, 2026: CISA Republication - Initial CISA Republication of Mitsubishi Electric 2026-005 advisory
- September 17, 2026: MXF100S-N32, MXF100S-P32, MXF100S-8-N32, MXF100S-8-P32, MXF100S-16-N32, MXF100S-16-P32, LD78G4, and LD78G16 have been added as affected products and MI2532-W, MI2332-W, and NZ2GACP610-60 have been removed from affected products.
- September 17, 2026: CISA Republication update based on Mitsubishi Electric 2026-005 advisory
- November 5, 2026: NZ2CT-GN and FR-D800-E have been added as affected products.
- November 5, 2026: CISA Republication update based on Mitsubishi Electric 2026-005 advisory
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com