Mitsubishi Electric CC-Link IE TSN Communication Protocol Message Integrity Vulnerability (CVE-2026-13584)

Technical Analysis

CVE-2026-13584 is a CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel) flaw affecting the CC-Link IE TSN communication protocol used across an extensive Mitsubishi Electric product line, including MELSEC MX Controllers, master/local modules, motion modules, AC servos, inverters, remote I/O modules, GOT3000 HMIs, and related SDKs/software. Exploitation requires only network adjacency (AV:A) with low attack complexity and no privileges or user interaction (CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L), allowing an attacker to inject crafted packets under precise timing conditions to corrupt control input/output data, degrading integrity and availability without impacting confidentiality. No vendor fix is planned; mitigation relies entirely on physical/network access restrictions, network segmentation, and firewalling of the CC-Link IE TSN segment from untrusted hosts. This is a pure OT/industrial-network protocol vulnerability affecting real-time control communications on factory floor equipment, with no direct exposure of AI agent frameworks, LLM tooling, or API credentials; it is not agent-relevant.

Affected Systems

Wide range of Mitsubishi Electric products using CC-Link IE TSN, including MELSEC MX Controller MX-R/MX-F series, Master/local modules (RJ71GN11 series, FX5-CCLGN-MS), CC-Link IE TSN interface boards (NZ81GN11 series), Motion modules (RD78G series, FX5-SSC-G series), Motion Control Board MR-EM441G, numerous Block-type remote modules (NZ2GN series), AD/DA converter modules, CC-Link IE TSN couplers/bridges, Tension meters (LM7 series), AC Servo MELSERVO-J5/JET series, Inverter FR-A800/F800/E800 series, Industrial Robot CR800-D controller network cards, Industrial Computers MELIPC MI2532-W/MI2332-W, GOT3000 series HMIs, Motion Control Software (SWM-G), CC-Link IE TSN Communication Software, various SDKs/DeviceKits, MTR-S Linear Track System modules, and MELSOFT VIMA analysis software — all versions affected (vers:all/*).

Indicators of Compromise

• No specific IOCs published; this is a protocol-level design vulnerability rather than an active exploit campaign with known indicators.

Remediation Steps

1. 1

   Restrict physical and network access

   Control access to sites and control panels housing affected devices; lock control panels and Ethernet ports (e.g., with port lock accessories) to prevent unauthorized connection to the CC-Link IE TSN network.

2. 2

   Network segmentation and firewalling

   Operate affected products only within a trusted network, isolated from business networks and the internet, using firewalls to block communication with untrusted networks and hosts.

3. 3

   Access control configuration

   Properly configure credentials and access privileges on network devices at the boundary between trusted and external networks.

4. 4

   Follow vendor advisory

   Review Mitsubishi Electric's security advisory 2026-005 for detailed guidance, as no software fix is currently planned for this vulnerability.

5. 5

   Apply general ICS defense-in-depth practices

   Minimize network exposure for control systems, avoid direct internet connectivity, and use secure VPNs with proper patching when remote access is required.