# CVE-2026-13584: Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

Status: published. Published: 2026-07-30. Updated: 2026-11-05.

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Mitsubishi Electric Corporation / MELSEC MX Controller MX-R model MXR300-16: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-R model MXR300-32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-R model MXR300-64: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-R model MXR500-128: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-R model MXR500-256: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100-8-N32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100-8-P32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100-16-N32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100-16-P32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-N32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-P32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-8-N32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-8-P32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-16-N32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC MX Controller MX-F model MXF100S-16-P32: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Master/local module RJ71GN11-T2: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Master/local module RJ71GN11-SX: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Master/local module RJ71GN11-EIP: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Master/local module FX5-CCLGN-MS: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN interface board NZ81GN11-SX: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN interface board NZ81GN11-T2: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78G4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78G8: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78G16: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78G64: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78GHV: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module RD78GHW: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module FX5-40SSC-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion module FX5-80SSC-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC iQ-L Series Motion Module LD78G4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / MELSEC iQ-L Series Motion module LD78G16: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion Control Board MR-EM441G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-32D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-32T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-32TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-32DT: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-32DTE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-32D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-32T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-32TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-32DT: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-32DTE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GNCF1-32D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GNCF1-32T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GNCE3-32D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GNCE3-32DT: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A4-16D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A4-16DE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A2-16T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A2-16TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A42-16DT: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN12A42-16DTE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-16D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-16T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2S1-16TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-16D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-16T: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module NZ2GN2B1-16TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-8D: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-8D-K: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-8TE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-8TE-K: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-16DTE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNSS2-16DTE-K: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNS12A2-14DT: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Block-type remote module with safety functions NZ2GNS12A2-16DTE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Analog-Digital converter module NZ2GN2S-60AD4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Analog-Digital converter module NZ2GN2B-60AD4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Digital-Analog converter module NZ2GN2S-60DA4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Digital-Analog converter module NZ2GN2B-60DA4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN compatible coupler NZ2FT-GN: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN compatible coupler NZ2CT-GN: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / FPGA module NZ2GN2S-D41P01: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / FPGA module NZ2GN2S-D41D01: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / FPGA module NZ2GN2S-D41PD02: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Tension meter LM7-1LG: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Tension meter LM7-2LG: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5W-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5-G-HS: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5-G-RJ: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5-G-LL: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-J5D-G4: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-J5 MR-MD333G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-JET MR-JET-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / AC Servo MELSERVO-JET MR-JET-G4-HS: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Liner Track System MTR-S series Linear track control module MTR-SCU00-4G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Liner Track System MTR-S series Linear track control module MTR-SCU00-PG: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-A800/F800/E800 Series FR-A8NCG: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-A800/F800/E800 Series FR-A8NCG-S: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-A800/F800/E800 Series FR-A800-GN: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-A800/F800/E800 Series FR-E800-E: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-A800/F800/E800 Series FR-E800-SCE: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Inverter FR-D800 Series FR-D800-E: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Industrial Robot CR800-D series controller Network Base Card 2F-DQ535-TSN: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN expansion unit FCU8-EX569: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN-CC-Link IE Field Network bridge module NZ2GN-GFB: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN-AnyWireASLINK bridge module NZ2AW1GNAL: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Energy Measuring Unit CC-Link IE TSN Communication Unit EMU4-CM-TSN: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3715-FHCBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3712-WXCBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3715-XRBA: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3715-XRBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3712-XRBA: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3712-XRBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3710-XRBA: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3710-XRBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3708-XRBA: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / GOT3000 Series GT3708-XRBD: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN Communication Unit GT25-J71GN13-T2: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion Control Software SWM-G: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Motion Control Software SWM-G-N1: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN Communication Software for Windows SW1DND-CCIETCT-M: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Analysis Support Software MELSOFT VIMA SW1DNN-VIMA-M: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Master/Local module Designated communication LSI DeviceKit NZ2KT-NPETNG51: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote Station Communication LSI with GbE-PHY NZ2GACP620-60: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote Station Communication LSI with GbE-PHY NZ2GACP620-300: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote Station Communication LSI with GbE-PHY NZ2GACP621-90: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote Station Communication LSI with GbE-PHY NZ2GACP621-720: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / CC-Link IE TSN Master/Local module Designated communication LSI SDK SW1DNN-GN610SRC-M: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote station software development kit SW1DNC-GNSDK1S-M: all versions (affected). Source: CNA: Mitsubishi
- Mitsubishi Electric Corporation / Remote station software development kit SW1DNC-GNSDK2S-M: all versions (affected). Source: CNA: Mitsubishi

## Severity and prioritization

- CVSS 4.0: 7.1 (high); CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N; source: CNA: Mitsubishi

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-04; percentile 8.88%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-924

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf (CNA: Mitsubishi; vendor-advisory)

- https://jvn.jp/vu/JVNVU98879231/ (CNA: Mitsubishi; government-resource)

- https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07 (CNA: Mitsubishi; government-resource)

## Provenance

- CNA: Mitsubishi: https://www.cve.org/CVERecord?id=CVE-2026-13584; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-13584; retrieved 2026-11-05; source updated Not reported

Revision: 9eab9ac240111ef72f83d0223017290c6d3af05cf25788413fcb1596f1d4e99b

Canonical: https://y2.dev/cve/CVE-2026-13584

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.