CISA Issues Two Mitsubishi Electric Advisories: CC-Link IE TSN Packet Tampering and GX Works3 Block Password Bypass (CVE-2026-15688)
First merged summary for this story (no previous summary existed). Within the underlying advisories, the CC-Link IE TSN item is Update A to previously published advisory ICSA-26-211-07, and the GX Works3 item (CVE-2026-15688, advisory 2026-007) is a CISA republication of a Mitsubishi Electric advisory.
CISA published two Mitsubishi Electric advisories dated 2026-09-17: an updated ICSA-26-211-07 (Update A) warning that segment-attached attackers can tamper with CC-Link IE TSN control data via crafted packets under specific timing conditions, and a…
CISA updated its advisory ICSA-26-211-07 (Update A) on a CWE-924 improper enforcement of message integrity flaw in the Mitsubishi Electric CC-Link IE TSN communication protocol. An attacker on the same network segment can send specially crafted packets under specific timing conditions to tamper with control input and output values, causing incorrect operation or denial of service in affected products. Affected products span numerous models, including MELSEC MX controllers, RJ71GN11 modules, motion modules (RD78G/LD78G), FX5 units, and NZ2GN block-type remote modules. Separately, CISA republished Mitsubishi Electric advisory 2026-007 describing CVE-2026-15688, an incorrect implementation of the authentication algorithm (CWE-303) in GX Works3 and the bundled Motion Control Settings, affecting all versions. A local attacker can authenticate with an invalid block password, modify an executable module in memory, and view, tamper with, destroy, or delete control programs. The flaw has a CVSS v3.1 base score of 8.8 and a v4.0 score of 9.2. CISA recommends isolating control system networks and minimizing internet exposure. The two reports cover distinct vulnerabilities and contain no conflicting facts.
- ICSA-26-211-07 Update A: CWE-924 improper enforcement of message integrity in the CC-Link IE TSN communication protocol
- Segment-attached attackers can send specially crafted packets under specific timing conditions to tamper with control I/O values, causing incorrect operation or denial of service
- Affected CC-Link IE TSN products include MELSEC MX controllers, RJ71GN11 modules, motion modules (RD78G/LD78G), FX5 units, and NZ2GN block-type remote modules
- CVE-2026-15688 (Mitsubishi Electric advisory 2026-007): CWE-303 incorrect implementation of authentication algorithm in GX Works3 and bundled Motion Control Settings; all versions affected
- A local attacker can authenticate with an invalid block password, modify an executable module in memory, and view, tamper with, destroy, or delete control programs
- CVE-2026-15688 scores 8.8 on CVSS v3.1 and 9.2 on CVSS v4.0
- CISA mitigation guidance: isolate control system networks and minimize internet exposure
- Both advisories were published/updated by CISA on 2026-09-17
- CVEs
- CVE-2026-15688
- Vendors
- Mitsubishi ElectricCISA
- Organizations
- Mitsubishi ElectricCISA
Coverage
oldest first · one row per article · UTC- · Sep 17, 2026
CISA AdvisoriesFirst report
Mitsubishi Electric GX Works3 and Motion Control Settings
CISA warns CVE-2026-15688 lets a local attacker bypass block password authentication in Mitsubishi Electric GX Works3 and tamper with control programs.
- · Sep 17, 2026
Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)
CISA updated its CC-Link IE TSN advisory: segment-attached attackers can tamper with Mitsubishi Electric control data and trigger denial of service conditions.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15688 | Block password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting | 9.2 | — |