{"id":"CVE-2026-13584","aliases":["EUVD-2026-51024","GHSA-r2qx-6p3c-jwf2"],"status":"published","title":"Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol","description":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00191,"percentile":0.08843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-924"],"published":"2026-07-30T06:44:46Z","modified":"2026-11-05T06:40:48Z","products":[{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5-g"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5-g-hs"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5-g-ll"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5-g-rj"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5d-g4"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-j5w-g"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-j5 mr-md333g"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-jet mr-jet-g"},{"vendor":"mitsubishi electric corporation","product":"ac servo melservo-jet mr-jet-g4-hs"},{"vendor":"mitsubishi electric corporation","product":"analog-digital converter module nz2gn2b-60ad4"},{"vendor":"mitsubishi electric corporation","product":"analog-digital converter module nz2gn2s-60ad4"},{"vendor":"mitsubishi electric corporation","product":"analysis support software melsoft vima sw1dnn-vima-m"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a2-16t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a2-16te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a4-16d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a4-16de"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a42-16dt"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn12a42-16dte"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-16d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-16t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-16te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-32d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-32dt"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-32dte"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-32t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2b1-32te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-16d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-16t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-16te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-32d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-32dt"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-32dte"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-32t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gn2s1-32te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gnce3-32d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gnce3-32dt"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gncf1-32d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module nz2gncf1-32t"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gns12a2-14dt"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gns12a2-16dte"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-16dte"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-16dte-k"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-8d"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-8d-k"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-8te"},{"vendor":"mitsubishi electric corporation","product":"block-type remote module with safety functions nz2gnss2-8te-k"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn communication software for windows sw1dnd-ccietct-m"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn communication unit gt25-j71gn13-t2"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn compatible coupler nz2ct-gn"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn compatible coupler nz2ft-gn"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn expansion unit fcu8-ex569"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn interface board nz81gn11-sx"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn interface board nz81gn11-t2"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn master/local module designated communication lsi sdk sw1dnn-gn610src-m"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn-anywireaslink bridge module nz2aw1gnal"},{"vendor":"mitsubishi electric corporation","product":"cc-link ie tsn-cc-link ie field network bridge module nz2gn-gfb"},{"vendor":"mitsubishi electric corporation","product":"digital-analog converter module nz2gn2b-60da4"},{"vendor":"mitsubishi electric corporation","product":"digital-analog converter module nz2gn2s-60da4"},{"vendor":"mitsubishi electric corporation","product":"energy measuring unit cc-link ie tsn communication unit emu4-cm-tsn"},{"vendor":"mitsubishi electric corporation","product":"fpga module nz2gn2s-d41d01"},{"vendor":"mitsubishi electric corporation","product":"fpga module nz2gn2s-d41p01"},{"vendor":"mitsubishi electric corporation","product":"fpga module nz2gn2s-d41pd02"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3708-xrba"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3708-xrbd"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3710-xrba"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3710-xrbd"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3712-wxcbd"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3712-xrba"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3712-xrbd"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3715-fhcbd"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3715-xrba"},{"vendor":"mitsubishi electric corporation","product":"got3000 series gt3715-xrbd"},{"vendor":"mitsubishi electric corporation","product":"industrial robot cr800-d series controller network base card 2f-dq535-tsn"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-a800/f800/e800 series fr-a800-gn"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-a800/f800/e800 series fr-a8ncg"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-a800/f800/e800 series fr-a8ncg-s"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-a800/f800/e800 series fr-e800-e"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-a800/f800/e800 series fr-e800-sce"},{"vendor":"mitsubishi electric corporation","product":"inverter fr-d800 series fr-d800-e"},{"vendor":"mitsubishi electric corporation","product":"liner track system mtr-s series linear track control module mtr-scu00-4g"},{"vendor":"mitsubishi electric corporation","product":"liner track system mtr-s series linear track control module mtr-scu00-pg"},{"vendor":"mitsubishi electric corporation","product":"master/local module designated communication lsi devicekit nz2kt-npetng51"},{"vendor":"mitsubishi electric corporation","product":"master/local module fx5-cclgn-ms"},{"vendor":"mitsubishi electric corporation","product":"master/local module rj71gn11-eip"},{"vendor":"mitsubishi electric corporation","product":"master/local module rj71gn11-sx"},{"vendor":"mitsubishi electric corporation","product":"master/local module rj71gn11-t2"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-l series motion module ld78g16"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-l series motion module ld78g4"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100-16-n32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100-16-p32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100-8-n32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100-8-p32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-16-n32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-16-p32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-8-n32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-8-p32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-n32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-f model mxf100s-p32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-r model mxr300-16"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-r model mxr300-32"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-r model mxr300-64"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-r model mxr500-128"},{"vendor":"mitsubishi electric corporation","product":"melsec mx controller mx-r model mxr500-256"},{"vendor":"mitsubishi electric corporation","product":"motion control board mr-em441g"},{"vendor":"mitsubishi electric corporation","product":"motion control software swm-g"},{"vendor":"mitsubishi electric corporation","product":"motion control software swm-g-n1"},{"vendor":"mitsubishi electric corporation","product":"motion module fx5-40ssc-g"},{"vendor":"mitsubishi electric corporation","product":"motion module fx5-80ssc-g"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78g16"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78g4"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78g64"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78g8"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78ghv"},{"vendor":"mitsubishi electric corporation","product":"motion module rd78ghw"},{"vendor":"mitsubishi electric corporation","product":"remote station communication lsi with gbe-phy nz2gacp620-300"},{"vendor":"mitsubishi electric corporation","product":"remote station communication lsi with gbe-phy nz2gacp620-60"},{"vendor":"mitsubishi electric corporation","product":"remote station communication lsi with gbe-phy nz2gacp621-720"},{"vendor":"mitsubishi electric corporation","product":"remote station communication lsi with gbe-phy nz2gacp621-90"},{"vendor":"mitsubishi electric corporation","product":"remote station software development kit sw1dnc-gnsdk1s-m"},{"vendor":"mitsubishi electric corporation","product":"remote station software development kit sw1dnc-gnsdk2s-m"},{"vendor":"mitsubishi electric corporation","product":"tension meter lm7-1lg"},{"vendor":"mitsubishi electric corporation","product":"tension meter lm7-2lg"}],"references":[{"url":"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf","tags":["vendor-advisory"]},{"url":"https://jvn.jp/vu/JVNVU98879231/","tags":["government-resource"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07","tags":["government-resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13584"},{"url":"https://jvn.jp/vu/JVNVU98879231"},{"url":"https://github.com/advisories/GHSA-r2qx-6p3c-jwf2"}],"sources":{"cve":[{"id":"CVE-2026-13584","title":"Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol","description":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.","status":"published","published":"2026-07-30T06:44:46.128Z","modified":"2026-11-05T06:40:48.947Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-924"],"updated_at":"2026-11-05T09:07:36.520409Z"}],"euvd":[{"id":"EUVD-2026-51024","description":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.","status":"published","published":"2026-07-30T06:44:46Z","modified":"2026-11-05T06:40:48Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T13:14:14.77537Z"}],"ghsa":[{"id":"GHSA-r2qx-6p3c-jwf2","title":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel...","description":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, Industrial Computer MELIPC series, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Master/Local module Designated communication LSI, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.","status":"published","published":"2026-07-30T09:31:17Z","modified":"2026-08-04T06:32:37Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-924"],"updated_at":"2026-11-02T15:10:03.433591Z"}],"nvd":[{"id":"CVE-2026-13584","description":"Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.","status":"published","published":"2026-07-30T07:16:56.327Z","modified":"2026-11-05T07:17:26.37Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-924"],"updated_at":"2026-11-05T13:18:38.18683Z"}]}}