Technical impact
Mitsubishi Electric’s CC‑Link IE TSN protocol, used across a wide range of controller, module, and appliance product families, fails to enforce message integrity during transmission. An attacker who can reach the TSN network segment can send specially crafted packets with precise timing, thereby altering control input and output data. This may compromise device operation and can even lead to a denial‑of‑service condition by disrupting normal control functions. The weakness is catalogued as CWE‑924, a message integrity flaw.
Affected Systems
Affected products include a broad range of Mitsubishi Electric devices that use CC‑Link IE TSN: the MELSEC MX Controllers (MX‑R and MX‑F series), Master/local modules, CC‑Link IE TSN interface boards, Motion modules and Motion Control Boards, Block‑type remote modules (with and without safety functions), Analog‑Digital and Digital‑Analog converters, CC‑Link IE TSN compatible couplers, FPGA modules, Tension meters, AC Servo MELSERVO‑J5 and MELSERVO‑JET units, Liner Track System MTR‑S series linear track control modules, Inverter FR‑A800/F800/E800 Series, Industrial Robot CR800‑D controller Network Base Card, CC‑Link IE TSN expansion units, Field Network bridge modules, AnyWire ASLINK bridge modules, Energy Measuring Unit CC‑Link IE TSN Communication Unit, Industrial Computer MELIPC series, GOT3000 Series, CC‑Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSIs, and Remote Station Communication LSIs with GbE‑PHY.
Risk and Exploitability
The vulnerability receives a CVSS score of 7.1, indicating a high level of risk, while the EPSS score is below 1 %, suggesting a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the issue is driven by sending crafted packets over the CC‑Link IE TSN network, an attacker must have physical or logical access to that network segment. Successful exploitation could lead to control data tampering and service interruption on the affected devices.
