CC-Link IE TSN protocol security: the 2025–2026 CVE record, explained

CC-Link IE TSN is an open industrial Ethernet network maintained by the CC-Link Partner Association (CLPA), a Japan-based organization with, per its own site, more than 4,500 partner companies worldwide. CLPA's own technology page states it is "the world's first to adopt TSN (Time-Sensitive Networking) technology, which extends the standard Ethernet," placing the CC-Link IE TSN protocol at Layer 2 of the OSI reference model alongside standard Ethernet protocols running at Layers 3–7. For time synchronization, CLPA's page states the network uses IEEE 802.1AS to achieve "highly accurate time synchronization accuracy within ±1 μs," and IEEE 802.1Qbv to divide communication cycles into time slots so each connected station can schedule frame transmission according to priority. CC-Link IE TSN is the newest, "third generation" member of the broader CC-Link family, which also includes the original CC-Link fieldbus, CC-Link/LT for sensors and actuators, and CC-Link IE Field Network — the TSN variant is specifically positioned by CLPA for mixing different network traffic types on one physical network to support Industrial IoT (IIoT) and smart-factory deployments.

Per Mitsubishi Electric's own PSIRT advisory (2026-005, released 30 July 2026, last updated 17 September 2026), CVE-2026-13584 is an Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability (CWE-924) with a CVSS v4.0 base score of 7.1. Mitsubishi's advisory states plainly: "An attacker with access to a CC-Link IE TSN network may be able to tamper with communication data by sending specially crafted packets under specific timing conditions," and that "as a result, the attacker may be able to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly." The advisory lists 35 distinct product categories as affected, spanning MELSEC MX Controllers, master/local communication modules, motion modules, AC servos (MELSERVO-J5 and -JET), industrial robot network cards, inverters, GOT3000 HMIs and multiple SDKs — all at "all versions," meaning no unaffected firmware revision exists. CISA republished the finding as ICSA-26-211-07 (Update A).

No. Mitsubishi Electric's own advisory states explicitly that no fix is planned, and directs customers to mitigations instead. The advisory's "Mitigations / Workarounds" section recommends, verbatim in substance: restrict physical access to the affected products and to the CC-Link IE TSN network segment they connect to — by controlling site access, locking control panels that house the affected products or network devices, and locking Ethernet ports with port-lock accessories; use the affected products only within a trusted network where communication with untrusted networks and hosts is blocked by a firewall or equivalent control; and appropriately configure credentials and access privileges on network devices sitting at the boundary between trusted and external networks. Mitsubishi credits the discovery to Alessandro Di Pinto, Giovanni Dini Gentilini, Luca Cremona and Gabriele Quagliarella of Nozomi Networks, Inc. Because the vulnerability sits in the protocol's own message-integrity design rather than in one product's implementation bug, a firmware patch for any single device would not close the underlying gap across the other 34 affected product lines — which is consistent with Mitsubishi choosing network-segmentation mitigations over a patch.

No — it is at least the second within roughly 15 months. CVE-2025-3511, published 25 April 2025 (also credited to Mitsubishi Electric's own PSIRT disclosure), is an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) with a CVSS v3.1 base score of 7.5 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) — fully network-exploitable with no privileges or user interaction required. NVD's record describes it as allowing a remote, unauthenticated attacker to trigger denial-of-service by sending a specially crafted UDP packet to affected CC-Link IE TSN Remote I/O modules (NZ2GN series), Analog/Digital Converter modules, FPGA modules, several MELSEC iQ-R and iQ-F series modules (including RJ71GN11-T2, RJ71EN71, the R04/08/16/32/120ENCPU family, FX5-CCLGN-MS, FX5-ENET, FX5-ENET/IP), and CP610/CP620 communication LSIs. Two network-reachable denial-of-service findings against the same protocol family inside roughly 15 months is a pattern worth tracking, not a one-off.