EUVD-2026-51024
GHSA-r2qx-6p3c-jwf2
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent TSN access only (AV:A); 'specific timing conditions' raise complexity (AC:H); no auth/UI (PR:N/UI:N); control-data tampering gives I:H, DoS gives A:L, no data exposure (C:N).
Primary rating from Vendor (yd).
CVSS VectorVendor: yd
Lifecycle Timeline
2DescriptionCVE.org
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, Industrial Computer MELIPC series, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Master/Local module Designated communication LSI, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.
AnalysisAI
Communication-data tampering in Mitsubishi Electric's CC-Link IE TSN product family - spanning MELSEC MX Controllers, motion modules, MELSERVO-J5/JET AC servos, FR-A800/F800/E800 inverters, GOT3000 HMIs, remote I/O modules and TSN communication LSIs/SDKs - allows an attacker on the same CC-Link IE TSN network to forge control input/output values by injecting specially crafted packets under specific timing conditions. Because message integrity is not enforced on the channel (CWE-924), successful tampering can drive incorrect operation of the control function or produce a denial-of-service condition on the affected device. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
The affected technology is CC-Link IE TSN, Mitsubishi Electric's Gigabit industrial Ethernet fieldbus built on IEEE 802.1 Time-Sensitive Networking, used for deterministic real-time exchange of cyclic process I/O between masters/local stations, remote modules, servo drives, inverters, motion controllers and HMIs. The root cause is CWE-924, Improper Enforcement of Message Integrity During Transmission: frames carrying control input/output values are transmitted without adequate integrity protection (e.g., authenticated message integrity/MAC), so an on-network attacker can craft or alter packets and have them accepted as legitimate cyclic data. The dependence on 'specific timing conditions' indicates the attack must interleave with the TSN cyclic schedule to have a forged frame consumed in place of the genuine one, so the weakness is at the protocol/link layer rather than in any single product's application logic - which is why the same defect propagates across the entire CC-Link IE TSN device line and its communication LSIs/SDKs.
RemediationAI
No vendor-released fixed version is identified in the available data (EUVD lists 'all versions' affected and the reference is an advisory PDF, not a tagged release), so treat mitigation as compensating-control-driven and consult https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf (Mitsubishi Electric advisory 2026-005) for any product-specific patches or firmware as they are published. Because the flaw is exploitable only from the CC-Link IE TSN network, the primary control is network isolation: place CC-Link IE TSN segments on dedicated, physically or logically separated networks behind an industrial firewall, and do not bridge them to office IT or the internet. Restrict physical and logical access to the TSN switches and cabling to authorized personnel, and disable or lock down any unused ports on switches and devices. Employ IP/MAC filtering and, where supported, VLAN segmentation so only known master/local and remote stations can communicate; use a VPN for any remote engineering access. The trade-off of strict segmentation is reduced remote diagnostics/engineering convenience, but it directly removes the adjacent-network access the attack requires. Monitor the segment for anomalous or malformed cyclic traffic to detect tampering attempts.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today