CC-Link IE TSN CVE-2026-13584: OT Protocol Vulnerability Enabling Control I/O Value Tampering from Adjacent Networks

1. Basic Information

• Article Name: JVNVU#98879231: Incomplete Integrity Verification in CC-Link IE TSN Communication Protocol for Multiple Mitsubishi Electric Products
• Publisher: JVN
• Publication Date: 2026-08-03
• Severity: High
• Original Source: https://jvn.jp/vu/JVNVU98879231/index.html
• Related Sources: Mitsubishi Electric PSIRT 2026-005, CISA ICSA-26-211-07
• Related Entities: CVE-2026-13584, CWE-924, CC-Link IE TSN, MELSEC MX, MELSERVO, GOT3000, Industrial Robots and 35 other categories (all versions)
• CVSS v4.0: 7.1 (AV:A/AC:L/AT:N/PR:N/UI:N/VI:H/VA:L)

2. Executive Summary

A protocol-level vulnerability in CC-Link IE TSN allows an unauthenticated attacker with physical or adjacent network access to send crafted packets at specific timings. This can tamper with control input/output values, causing malfunctions, control interference, or DoS.

3. Attack Flow

1. The attacker reaches the CC-Link IE TSN segment from a factory network, maintenance port, or compromised engineering workstation.
2. The attacker observes or estimates network traffic and the control cycle/timing.
3. The attacker exploits the lack of proper message integrity enforcement to inject crafted packets at a specific timing.
4. The target device processes the packets as valid messages, and the control I/O values are altered.
5. Actuators, servos, robots, or remote I/O devices malfunction, suffer control interference, or stop.

4. Attacker Position and Execution Points

• The attacker needs adjacent access to CC-Link IE TSN, which does not always mean direct access from the Internet.
• Execution points include unauthorized connected terminals, maintenance PCs, compromised OT/IT bridges, and open Ethernet ports.
• The impact spreads beyond controllers to servos, robots, inverters, HMIs, remote I/O, and industrial PCs.

5. Visibility for Victims and Administrators

• Operators see sensor/actuator value mismatches, unexpected movements, interlocks, or device timeouts/stops.
• Network administrators see regular traffic within the segment, making it hard to judge legitimacy based only on source MAC/IP.
• The key indicator is that process values change without any engineering changes or audits.

6. Success and Failure Conditions

Success Conditions

• The attacker achieves physical or logical access to the CC-Link IE TSN segment.
• The target product uses the affected protocol, and the attacker matches the packet timing.
• Port security, network segmentation, and anomaly detection are insufficient.

Failure Conditions

• Physical control of cabinets, rooms, and Ethernet ports.
• Isolation of trusted networks and blocking communication with untrusted hosts using firewalls/ACLs.
• Use of network admission control, fixed switch ports, OT IDS, and process safety controls to block abnormal packets and values.

7. What Happens on Success

• Tampering with control I/O values, device control interference, malfunctions, or DoS.
• Potential physical impact on manufacturing quality, safety, and equipment availability.
• Cross-cutting risk across many products and all versions due to shared protocol weaknesses.

8. Observable Logs

• Email: Not applicable.
• Proxy/SWG/DNS: Usually not observed as traffic remains within the local OT segment.
• Endpoint/EDR: Packet crafting tools on engineering workstations, NIC promiscuous mode, unknown USB/network adapters. Specialized devices often lack EDR support.
• Identity/IdP: Network access/VPN/NAC authentication and maintenance account usage. Protocol packets themselves are unauthenticated.
• SaaS/Cloud: Only when remote maintenance/ZTNA audits are present.
• Network: Unknown MAC addresses on SPAN/TAP, duplicate/abnormal sequences and timings, unexpected I/O writes, broadcast/multicast patterns, link up/down events, and port moves.
• Process/Safety: Differences between commanded and actual values in PLCs/HMIs/alarm historians, discrepancies with recipe/change management, and activation of safety relays/interlocks.

9. Attack Success Determination

• Contact Only: Segment connection, scanning, or traffic observation.
• User Interaction: None required.
• Initial Execution: Confirmation of crafted packet transmission via packet capture.
• Malware or Successful Authentication: Not applicable. Acceptance of protocol messages marks the success point.
• Information Theft/Session Compromise: Not the primary goal of this vulnerability.
• Subsequent Compromise Confirmation: I/O value tampering, malfunctions, or DoS aligning with packet timestamps.

10. Investigation Playbook

• Trigger: Unexplained I/O changes, device stops, unknown MAC addresses, or packet anomalies outside of maintenance hours.
• Initial Check: Prioritize safety, coordinate with operators to stabilize the process state. Preserve packet captures, switch CAM/port data, and alarm/historian timestamps.
• Endpoints: Check engineering/maintenance PCs, USBs, tools, accounts, and EDR on the same segment.
• Authentication/Cloud: Cross-reference VPN, ZTNA, NAC, and remote maintenance sessions.
• Subsequent Actions: Check the affected 35 product groups across the same segment, bridges, and redundant lines.
• Containment: Isolate unauthorized ports/hosts, separate cells/zones, enable manual/local safe modes, and verify configurations, firmware, and process values.
• Determination Categories: Adjacent Access / Packet Injection Suspected / Malformed Packet Confirmed / I/O Integrity Loss / Physical Impact.

11. Defense and Detection Ideas

• Single Event: Unregistered MAC addresses, port link-ups outside of maintenance, unexpected I/O writes.
• Time-Series Correlation: Port connection -> Traffic observation -> Specific timing packet -> I/O value change -> Alarm/interlock.
• Hunting: Asset inventory check and vulnerable version confirmation across all devices, unmanaged switches/bridges, IT-OT dual-homed hosts, and portable engineering PCs.
• Log Shortages: OT packet captures, switch port audits, time synchronization, historians, and device protocol logs.
• Priority Measures: Physical ports/cabinets, zones/conduits, NAC/ACLs, OT IDS, and independent safety interlocks.

12. Facts / Inference / Hypothesis

Facts

• The message integrity enforcement flaw was published as CVE-2026-13584/CWE-924.
• Adjacent access, low complexity, and zero credentials/user interaction allow control I/O value tampering and DoS.
• Mitsubishi Electric lists all versions across 35 product categories as affected and advises physical/network mitigations rather than patches.

Inference

• Pure IT logs struggle to capture this; time-series correlation of packets, switches, historians, and safety alarms is necessary.
• Because of shared protocol implementations, the same attack primitives can spread to different devices on the same segment.

Hypothesis

• Mixing malicious traffic with regular maintenance traffic from a compromised engineering workstation makes detection harder than using an external terminal.

13. MITRE ATT&CK Mapping

Mapped primarily to ICS ATT&CK.

• T0842 Network Sniffing (Medium, if observation is used to determine timing)
• T0836 Modify Parameter (High)
• T0855 Unauthorized Command Message (High)
• T0813 Denial of Control / T0826 Loss of Availability (High)
• T0827 Loss of Control / T0831 Manipulation of Control (Medium to High)

14. Unknowns and Additional Investigations

• Packet fields, timing windows, reproducibility, and device-specific behaviors.
• Vendor plans for protocol/firmware fixes.
• Mitigation effects in safety-certified configurations.
• Evidence of active exploitation or global incidents.
• Impact on third-party CC-Link IE TSN implementations.

15. Impact on SOCs and Organizations

Factory automation products and CC-Link IE TSN are widely used in global industrial environments. Organizations must audit segments, target model numbers, maintenance ports, remote access points, and dual-homed endpoints, going beyond simply checking for patches. SOCs and plant maintenance teams should establish joint decision-making criteria that factor in safety, quality, and operational impacts rather than relying solely on standard IT incident severity levels.

16. Summary by Role

• For SOCs: Correlate unknown MACs/ports and packet anomalies with historian I/O changes and alarms, assuming EDR is not present.
• For Administrators: Assume all versions are affected, and implement physical access controls, cabinet/port locks, zone separation, ACLs/NAC, and OT IDS.
• For Users: Do not dismiss unexplained display values, malfunctions, or stops as simple equipment failures. Record timestamps and report them immediately to maintenance teams or SOCs.