Executive brief
Mitsubishi Electric's CC-Link IE TSN communication protocol, used in industrial control systems to coordinate manufacturing equipment and factory automation, contains a vulnerability allowing network-based denial-of-service attacks. An attacker on the same network can craft specific timing-based packets to disrupt or corrupt communications between controllers and equipment, causing production systems to malfunction or halt. This affects dozens of Mitsubishi industrial automation products including PLCs, motion controllers, and remote modules used in factories worldwide.
Technical details
The vulnerability exists in the CC-Link IE TSN communication protocol implementation across multiple Mitsubishi Electric products. An attacker with network access to the same segment can send specially crafted packets that exploit timing conditions to tamper with communication data, violating the integrity of control messages. The attack vector is network-based with adjacent/local network reachability required. Successful exploitation allows denial of service by interfering with control functions or inducing incorrect operation of affected industrial equipment. All versions of affected MELSEC MX controllers, motion modules, remote I/O modules, and interface boards are impacted. Mitigation details and patches are not specified in this advisory.
Affected products
- Mitsubishi Electric MELSEC MX Controller MX-R MXR300-16
- Mitsubishi Electric MELSEC MX Controller MX-R MXR300-32
- Mitsubishi Electric MELSEC MX Controller MX-R MXR300-64
- Mitsubishi Electric MELSEC MX Controller MX-R MXR500-128
- Mitsubishi Electric MELSEC MX Controller MX-R MXR500-256
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100-8-N32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100-8-P32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100-16-N32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100-16-P32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-N32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-P32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-8-N32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-8-P32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-16-N32
- Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-16-P32
- Mitsubishi Electric Master/local module RJ71GN11-T2 all
- Mitsubishi Electric Master/local module RJ71GN11-SX all
- Mitsubishi Electric Master/local module RJ71GN11-EIP all
- Mitsubishi Electric Master/local module FX5-CCLGN-MS all
- Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-SX all
- Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-T2 all
- Mitsubishi Electric Motion module RD78G4 all
- Mitsubishi Electric Motion module RD78G8 all
- Mitsubishi Electric Motion module RD78G16 all
- Mitsubishi Electric Motion module RD78G64 all
- Mitsubishi Electric Motion module RD78GHV all
- Mitsubishi Electric Motion module RD78GHW all
- Mitsubishi Electric Motion module FX5-40SSC-G all
- Mitsubishi Electric Motion module FX5-80SSC-G all
- Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G4 all
- Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G16 all
- Mitsubishi Electric Motion Control Board MR-EM441G all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32D all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32T all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32TE all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32DT all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-32DTE all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32D all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32T all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32TE all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32DT all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-32DTE all
- Mitsubishi Electric Block-type remote module NZ2GNCF1-32D all
- Mitsubishi Electric Block-type remote module NZ2GNCF1-32T all
- Mitsubishi Electric Block-type remote module NZ2GNCE3-32D all
- Mitsubishi Electric Block-type remote module NZ2GNCE3-32DT all
- Mitsubishi Electric Block-type remote module NZ2GN12A4-16D all
- Mitsubishi Electric Block-type remote module NZ2GN12A4-16DE all
- Mitsubishi Electric Block-type remote module NZ2GN12A2-16T all
- Mitsubishi Electric Block-type remote module NZ2GN12A2-16TE all
- Mitsubishi Electric Block-type remote module NZ2GN12A42-16DT all
- Mitsubishi Electric Block-type remote module NZ2GN12A42-16DTE all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16D all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16T all
- Mitsubishi Electric Block-type remote module NZ2GN2S1-16TE all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16D all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16T all
- Mitsubishi Electric Block-type remote module NZ2GN2B1-16TE all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D-K all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE-K all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE-K all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-14DT all
- Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-16DTE all
- Mitsubishi Electric Analog-Digital converter module NZ2GN2S-60AD4 all
- Mitsubishi Electric Analog-Digital converter module NZ2GN2B-60AD4 all
- Mitsubishi Electric Digital-Analog converter module NZ2GN2S-60DA4 all
- Mitsubishi Electric Digital-Analog converter module NZ2GN2B-60DA4 all
- Mitsubishi Electric CC-Link IE TSN compatible coupler NZ2FT-GN all
- Mitsubishi Electric FPGA module NZ2GN2S-D41P01 all
- Mitsubishi Electric FPGA module NZ2GN2S-D41D01 all
- Mitsubishi Electric FPGA module NZ2GN2S-D41PD02 all
Timeline
- 2026-09-17: disclosed