Read the docs
TI-2026-11507 Aliases CVE-2026-13584GHSA-r2qx-6p3c-jwf2

Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

Priority LOW 30CWE-924Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mitsubishi Electric CorporationMELSEC MX Controller MX-R model MXR300-16all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-R model MXR300-32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-R model MXR300-64all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-R model MXR500-128all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-R model MXR500-256all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100-8-N32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100-8-P32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100-16-N32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100-16-P32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-N32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-P32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-8-N32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-8-P32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-16-N32all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC MX Controller MX-F model MXF100S-16-P32all versions—No fix listedCNA
Mitsubishi Electric CorporationMaster/local module RJ71GN11-T2all versions—No fix listedCNA
Mitsubishi Electric CorporationMaster/local module RJ71GN11-SXall versions—No fix listedCNA
Mitsubishi Electric CorporationMaster/local module RJ71GN11-EIPall versions—No fix listedCNA
Mitsubishi Electric CorporationMaster/local module FX5-CCLGN-MSall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN interface board NZ81GN11-SXall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN interface board NZ81GN11-T2all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78G4all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78G8all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78G16all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78G64all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78GHVall versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module RD78GHWall versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module FX5-40SSC-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationMotion module FX5-80SSC-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC iQ-L Series Motion Module LD78G4all versions—No fix listedCNA
Mitsubishi Electric CorporationMELSEC iQ-L Series Motion module LD78G16all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion Control Board MR-EM441Gall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-32Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-32Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-32TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-32DTall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-32DTEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-32Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-32Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-32TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-32DTall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-32DTEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GNCF1-32Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GNCF1-32Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GNCE3-32Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GNCE3-32DTall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A4-16Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A4-16DEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A2-16Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A2-16TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A42-16DTall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN12A42-16DTEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-16Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-16Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2S1-16TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-16Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-16Tall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module NZ2GN2B1-16TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-8Dall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-8D-Kall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-8TEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-8TE-Kall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-16DTEall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNSS2-16DTE-Kall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNS12A2-14DTall versions—No fix listedCNA
Mitsubishi Electric CorporationBlock-type remote module with safety functions NZ2GNS12A2-16DTEall versions—No fix listedCNA
Mitsubishi Electric CorporationAnalog-Digital converter module NZ2GN2S-60AD4all versions—No fix listedCNA
Mitsubishi Electric CorporationAnalog-Digital converter module NZ2GN2B-60AD4all versions—No fix listedCNA
Mitsubishi Electric CorporationDigital-Analog converter module NZ2GN2S-60DA4all versions—No fix listedCNA
Mitsubishi Electric CorporationDigital-Analog converter module NZ2GN2B-60DA4all versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN compatible coupler NZ2FT-GNall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN compatible coupler NZ2CT-GNall versions—No fix listedCNA
Mitsubishi Electric CorporationFPGA module NZ2GN2S-D41P01all versions—No fix listedCNA
Mitsubishi Electric CorporationFPGA module NZ2GN2S-D41D01all versions—No fix listedCNA
Mitsubishi Electric CorporationFPGA module NZ2GN2S-D41PD02all versions—No fix listedCNA
Mitsubishi Electric CorporationTension meter LM7-1LGall versions—No fix listedCNA
Mitsubishi Electric CorporationTension meter LM7-2LGall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5W-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5-G-HSall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5-G-RJall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5-G-LLall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-J5D-G4all versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-J5 MR-MD333Gall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-JET MR-JET-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationAC Servo MELSERVO-JET MR-JET-G4-HSall versions—No fix listedCNA
Mitsubishi Electric CorporationLiner Track System MTR-S series Linear track control module MTR-SCU00-4Gall versions—No fix listedCNA
Mitsubishi Electric CorporationLiner Track System MTR-S series Linear track control module MTR-SCU00-PGall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-A800/F800/E800 Series FR-A8NCGall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-A800/F800/E800 Series FR-A8NCG-Sall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-A800/F800/E800 Series FR-A800-GNall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-A800/F800/E800 Series FR-E800-Eall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-A800/F800/E800 Series FR-E800-SCEall versions—No fix listedCNA
Mitsubishi Electric CorporationInverter FR-D800 Series FR-D800-Eall versions—No fix listedCNA
Mitsubishi Electric CorporationIndustrial Robot CR800-D series controller Network Base Card 2F-DQ535-TSNall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN expansion unit FCU8-EX569all versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN-CC-Link IE Field Network bridge module NZ2GN-GFBall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN-AnyWireASLINK bridge module NZ2AW1GNALall versions—No fix listedCNA
Mitsubishi Electric CorporationEnergy Measuring Unit CC-Link IE TSN Communication Unit EMU4-CM-TSNall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3715-FHCBDall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3712-WXCBDall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3715-XRBAall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3715-XRBDall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3712-XRBAall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3712-XRBDall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3710-XRBAall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3710-XRBDall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3708-XRBAall versions—No fix listedCNA
Mitsubishi Electric CorporationGOT3000 Series GT3708-XRBDall versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN Communication Unit GT25-J71GN13-T2all versions—No fix listedCNA
Mitsubishi Electric CorporationMotion Control Software SWM-Gall versions—No fix listedCNA
Mitsubishi Electric CorporationMotion Control Software SWM-G-N1all versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN Communication Software for Windows SW1DND-CCIETCT-Mall versions—No fix listedCNA
Mitsubishi Electric CorporationAnalysis Support Software MELSOFT VIMA SW1DNN-VIMA-Mall versions—No fix listedCNA
Mitsubishi Electric CorporationMaster/Local module Designated communication LSI DeviceKit NZ2KT-NPETNG51all versions—No fix listedCNA
Mitsubishi Electric CorporationRemote Station Communication LSI with GbE-PHY NZ2GACP620-60all versions—No fix listedCNA
Mitsubishi Electric CorporationRemote Station Communication LSI with GbE-PHY NZ2GACP620-300all versions—No fix listedCNA
Mitsubishi Electric CorporationRemote Station Communication LSI with GbE-PHY NZ2GACP621-90all versions—No fix listedCNA
Mitsubishi Electric CorporationRemote Station Communication LSI with GbE-PHY NZ2GACP621-720all versions—No fix listedCNA
Mitsubishi Electric CorporationCC-Link IE TSN Master/Local module Designated communication LSI SDK SW1DNN-GN610SRC-Mall versions—No fix listedCNA
Mitsubishi Electric CorporationRemote station software development kit SW1DNC-GNSDK1S-Mall versions—No fix listedCNA
Mitsubishi Electric CorporationRemote station software development kit SW1DNC-GNSDK2S-Mall versions—No fix listedCNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13584
  2. 2026-10-03 Alias added: GHSA-r2qx-6p3c-jwf2
  3. 2026-11-05 Affected versions changed · CNA

References

  • TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
  • TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
  • TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
  • TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
  • TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
  • TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
See all 151 →

Sources