Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)
CISA updated its CC-Link IE TSN advisory: segment-attached attackers can tamper with Mitsubishi Electric control data and trigger denial of service conditions.
CISA updated its advisory (ICSA-26-211-07 Update A) on a CWE-924 improper enforcement of message integrity flaw in the Mitsubishi Electric CC-Link IE TSN communication protocol. An attacker on the same network segment can send specially crafted packets under specific timing conditions to tamper with control input and output values, causing incorrect operation or denial of service in affected products. Affected products span numerous models, including MELSEC MX controllers, RJ71GN11 modules, motion modules (RD78G/LD78G), FX5 units, and NZ2GN block-type remote modules.
- CWE-924 flaw lets segment-attached attackers tamper with control I/O values via crafted packets
- Specific timing conditions enable denial of service or incorrect device operation
- Dozens of MELSEC MX, motion, and remote I/O module models are affected
- This is Update A to previously published advisory ICSA-26-211-07
- Vendors
- Mitsubishi ElectricCISA
- Organizations
- Mitsubishi ElectricCISA
From the original article
4 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.