CVE-2026-13584: Mitsubishi Electric MELSEC DoS Vulnerability

CVE-2026-13584 Overview

CVE-2026-13584 is an Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability [CWE-924] affecting a broad range of Mitsubishi Electric industrial products that use the CC-Link IE TSN network. An attacker with access to the CC-Link IE TSN network can transmit specially crafted packets under specific timing conditions to tamper with control input and output values. Successful exploitation can cause a denial-of-service condition, disrupt control functions, or force affected products to operate incorrectly. The flaw impacts controllers, servos, inverters, robot controllers, communication modules, and related software development kits used across industrial automation environments.

Critical Impact
Adjacent-network attackers can tamper with industrial control traffic on CC-Link IE TSN networks, causing incorrect operation or denial-of-service of connected controllers, servos, robots, and I/O modules.

Affected Products

MELSEC MX Controller (MX-R and MX-F models), Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, and Block-type remote modules (including safety-function variants)
AC Servo MELSERVO-J5 and MELSERVO-JET, Inverter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Network Base Card, and MTR-S series Linear track control module
MELIPC Industrial Computer series, GOT3000 Series, Motion Control Software, MELSOFT VIMA, and multiple Designated communication LSI DeviceKits and SDKs

Discovery Timeline

2026-07-30 - CVE-2026-13584 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13584

Vulnerability Analysis

The vulnerability stems from insufficient integrity enforcement on messages transmitted over the CC-Link IE TSN communication channel. Affected Mitsubishi Electric products accept and process communication frames without adequately validating that the payload has not been altered in transit. An attacker positioned on the CC-Link IE TSN network can inject crafted packets that manipulate control input and output values exchanged between master, local, and remote stations. Because these values drive real-time process logic, tampering can disrupt deterministic behavior expected by controllers, servos, and I/O modules.

The attack requires adjacent-network access rather than remote internet reachability. Exploitation depends on meeting specific timing conditions tied to the deterministic scheduling of the TSN protocol. The impact skews toward integrity and availability rather than confidentiality, aligning with the [CWE-924] weakness class.

Root Cause

Affected products fail to enforce end-to-end message integrity on CC-Link IE TSN frames. Without cryptographic authentication or robust integrity checks on control payloads, tampered frames are accepted as legitimate by receiving stations. This trust in the channel allows falsified control input/output values to influence process logic.

Attack Vector

An attacker must gain access to the CC-Link IE TSN network segment, for example by compromising an engineering workstation, an unmanaged network port, or a device already attached to the fieldbus. The attacker then sends specially crafted packets timed against the TSN schedule to overwrite legitimate control values. No authentication or user interaction is required to trigger the flaw.

No verified public exploit code is available. Refer to the Mitsubishi Electric Security Advisory for detailed technical guidance.

Detection Methods for CVE-2026-13584

Indicators of Compromise

Unexpected changes in control input/output values on CC-Link IE TSN devices that do not correlate with engineering commands or scheduled logic
Unplanned denial-of-service events, controller faults, or servo/inverter stops occurring on the TSN network segment
Presence of unauthorized hosts, MAC addresses, or engineering tools on CC-Link IE TSN VLANs

Detection Strategies

Deploy passive OT network monitoring capable of parsing CC-Link IE TSN traffic and alerting on malformed frames, off-schedule transmissions, or unexpected source stations
Baseline normal cyclic traffic patterns between master and remote stations, then alert on deviations in packet timing, frame counts, or payload ranges
Correlate PLC diagnostic events, controller error codes, and TSN link statistics with SIEM telemetry to surface tampering attempts

Monitoring Recommendations

Log and review switch port activity for new MAC/IP additions on CC-Link IE TSN segments, and forward these events to a central data lake for retention
Monitor engineering workstations that connect to the TSN network for lateral movement, unauthorized tool execution, or crafted-packet generation utilities
Track process variable anomalies from historians and SCADA to identify signs of injected control values

How to Mitigate CVE-2026-13584

Immediate Actions Required

Review the Mitsubishi Electric Security Advisory 2026-005 and inventory all affected controllers, modules, servos, inverters, robots, and SDK-based devices
Restrict physical and logical access to CC-Link IE TSN network segments to authorized engineering personnel and devices only
Segment TSN fieldbus traffic from enterprise and internet-facing networks using firewalls, VLANs, and unidirectional gateways where feasible

Patch Information

Mitsubishi Electric has published advisory 2026-005 describing affected products and remediation guidance. Consult the Mitsubishi Electric Security Advisory for the current list of fixed versions, mitigations per product family, and update procedures. Apply firmware and software updates in accordance with vendor instructions and validated change-management processes.

Workarounds

Use IP filtering or access control lists on managed switches to allow only trusted stations to communicate on CC-Link IE TSN segments
Physically secure network cabinets, switch ports, and engineering interfaces to prevent adjacent-network access by unauthorized parties
Deploy intrusion detection at OT/IT boundaries and monitor for anomalous traffic targeting affected Mitsubishi Electric products until patches are applied

bash

# Example: restrict TSN segment access with a switch ACL (vendor syntax varies)
access-list 110 permit ip host 192.0.2.10 192.0.2.0 0.0.0.255
access-list 110 permit ip host 192.0.2.11 192.0.2.0 0.0.0.255
access-list 110 deny   ip any 192.0.2.0 0.0.0.255 log
interface GigabitEthernet0/1
 ip access-group 110 in