CVE-2026-13584: Mitsubishi Electric MELSEC MX-R CC-Link IE TSN Tampering and DoS — Detection and Remediation Guide for OT Defenders

CISA has published ICSA-26-211-07 (Update A) covering a vulnerability in the CC-Link IE TSN communication protocol implementation used by Mitsubishi Electric MELSEC MX Controllers. Tracked as CVE-2026-13584, the flaw allows an attacker positioned on the same network segment as the affected controller to inject specially crafted packets under specific timing conditions, tampering with legitimate communication data. The practical outcomes are serious for any operational technology (OT) environment: interference with the controller's control function, incorrect operation of the controlled process, or an outright denial-of-service condition on the device.

Affected products, per the advisory:

• Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16 — all versions
• Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32 — all versions
• Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64 — all versions

Because CC-Link IE TSN is the deterministic backbone protocol for Mitsubishi's high-speed motion and I/O control, a controller that receives tampered traffic can behave unpredictably in ways that matter physically — think axis drift on a motion line, I/O state corruption, or a halted production cell. This is not a data-theft bug; it is an availability and integrity bug in a control-plane protocol. For defenders running Mitsubishi MELSEC MX-R hardware, this advisory warrants immediate compensating controls even before vendor firmware updates land.

Why Defenders Should Care

Three factors elevate this beyond a routine advisory:

1. Same-segment access is a lower bar than it sounds. The exploitation prerequisite is adjacency on the OT network segment. Any environment with flat Layer 2 topology between engineering workstations, HMIs, and controllers — still common in brownfield plants — satisfies that prerequisite. A compromised Windows engineering station, a rogue laptop on a maintenance switch, or a pivot from IT through a poorly configured firewall rule all qualify.
2. Integrity tampering on a TSN control protocol is a safety-adjacent issue. Interfering with a control function or causing incorrect operation in a deterministic control network can cascade into physical process upset, not just a crashed service.
3. Timing-condition vulnerabilities resist signature detection. Because exploitation depends on specially crafted packets arriving under specific timing conditions, naive IDS signatures will miss it. Detection strategy must focus on protocol anomaly and behavioral signals rather than payload matching.

Technical Analysis

Affected Component

The vulnerability resides in the CC-Link IE TSN communication protocol stack as implemented on the MELSEC MX-R controller family. CC-Link IE TSN combines gigabit Ethernet with IEEE 802.1 Time-Sensitive Networking extensions to deliver deterministic, scheduled cyclic communication between controllers, remote I/O, motion modules, and other stations on the segment.

Attack Mechanics (Defender's View)

Based on the advisory language, the attack chain looks like this:

1. Positioning: The attacker gains Layer 2 adjacency to the CC-Link IE TSN segment — via a compromised endpoint, unauthorized device on the control switch, or a misrouted path from a supervisory/HMI network.
2. Crafted packet injection: The attacker transmits malformed or protocol-violating frames crafted to be processed by the controller's TSN protocol handler. The frames must arrive within specific timing windows relative to the cyclic communication schedule — consistent with injecting traffic that collides with or displaces legitimate scheduled frames.
3. Impact: The controller processes the tampered communication data, producing one of two outcomes: (a) the control function is interfered with or operates incorrectly (integrity impact — the controller acts on attacker-influenced data), or (b) the device enters a denial-of-service state (availability impact — cyclic communication breaks down).

The timing requirement tells us something useful defensively: exploitation likely requires sustained, precisely-timed packet transmission — meaning an attack will generate anomalous frame-rate or frame-timing patterns on the segment, not a single packet.

Exploitation Status

At publication, there is no public proof-of-concept exploit, no confirmed in-the-wild exploitation, and CVE-2026-13584 is not listed in the CISA Known Exploited Vulnerabilities catalog. This is a proactive defensive window. Treat it as such: the exploitation class (same-segment protocol tampering) is well-understood in OT threat tradecraft, and adversaries targeting manufacturing have demonstrated comfort with industrial protocol manipulation. Do not wait for a KEV entry to act on segmentation.

Detection & Response

A candid note first: detecting timing-condition protocol tampering at the packet level requires ICS-aware network monitoring (Zeek/Suricata with OT protocol dissectors, or a dedicated OT visibility platform) mirrored off the control switches. Endpoint telemetry on controllers is effectively nil — these are embedded devices. The detections below therefore target the realistic observation points: engineering workstations and other endpoints on the OT segment (where an attacker's foothold would originate), and syslog/firewall telemetry flowing into your SIEM.

Sigma Rules

---
title: Unexpected Process Initiating Connections to MELSEC Controller Segment
id: 3f8a1c52-7d4e-4b9a-a2c1-9e5d6f7a8b01
status: experimental
description: Detects non-engineering applications on OT-adjacent Windows hosts initiating network connections to ports used by CC-Link IE family cyclic communication. An attacker staging from a compromised workstation to inject crafted frames into a MELSEC MX-R segment would generate this pattern. Tune the destination port list to the documented controller ports and the Image exclusion list to your installed engineering software suite.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07
  - https://attack.mitre.org/techniques/T0883/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.ics
  - attack.t0883
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 45237
      - 45238
    Initiated: 'true'
  filter_engineering_apps:
    Image|contains:
      - '\GX Works\'
      - '\MELSOFT\'
      - '\Mitsubishi\'
      - '\mxconfigurator\'
  condition: selection and not 1 of filter_*
falsepositives:
  - Approved engineering software not yet in the exclusion list
  - HMI/SCADA polling from supervisory hosts
level: high
---
title: Suspicious Raw Socket or Packet Crafting Tool Execution on OT-Adjacent Hosts
id: 6b2e9d14-1a7c-4f83-b5d2-8c4a6e9f1023
status: experimental
description: Detects execution of packet crafting and raw network tooling (nping, hping, scapy-driven Python, pktgen-style utilities) on hosts adjacent to OT segments. Injection of timing-conditioned crafted frames against CC-Link IE TSN requires this class of tooling, which has no legitimate role on engineering workstations outside controlled test benches.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\nping.exe'
      - '\hping3.exe'
      - '\packeth.exe'
      - '\ostinato.exe'
  selection_cli:
    CommandLine|contains:
      - 'scapy'
      - 'sendp('
      - 'RawSocket'
      - '--rawip'
      - 'hping'
  condition: 1 of selection_*
falsepositives:
  - Authorized penetration testing under change control
  - Network engineering diagnostics on IT segments (scope this rule to OT-adjacent host groups)
level: high

KQL — Microsoft Sentinel

This hunt assumes you are ingesting firewall and OT switch telemetry into Sentinel (CommonSecurityLog via CEF, or Syslog) and Defender for Endpoint data from engineering workstations. The query surfaces hosts generating sustained high-rate connection attempts toward controller IPs — the behavioral footprint of timing-conditioned packet injection — and pairs it with endpoint process context.

// Hunt: anomalous connection volume to MELSEC MX-R controller IPs
// Replace the ControllerSubnet CIDRs with your actual OT control segments.
let ControllerIPs = dynamic(["10.20.30.0/24", "192.168.3.0/24"]);
let Threshold = 500; // connections per host per 5-minute bucket; baseline first
let OtTraffic =
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where ipv4_is_in_range(DestinationIP, tostring(ControllerIPs[0]))
         or ipv4_is_in_range(DestinationIP, tostring(ControllerIPs[1]))
    | summarize ConnCount = count(), DestPorts = make_set(DestinationPort)
        by SourceIP, bin(TimeGenerated, 5m)
    | where ConnCount > Threshold;
OtTraffic
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where ipv4_is_in_range(RemoteIP, tostring(ControllerIPs[0]))
         or ipv4_is_in_range(RemoteIP, tostring(ControllerIPs[1]))
    | summarize EndpointConns = count(), Processes = make_set(InitiatingProcessFileName)
        by LocalIP, DeviceName
) on $left.SourceIP == $right.LocalIP
| project TimeGenerated, SourceIP, DeviceName, ConnCount, DestPorts, Processes, EndpointConns
| order by ConnCount desc;

Velociraptor VQL

Use this artifact against suspected compromised engineering workstations to enumerate live connections toward the OT control segment and identify the owning process — rapid triage when the Sigma or KQL detections above fire.

-- Artifact: OT.Segment.Triage.MELSECConnections
-- Enumerate active connections from an engineering workstation toward
-- the MELSEC controller segment and resolve owning processes.
-- Adjust the subnet regex to your control VLAN addressing.

LET conns = SELECT Pid, Name, Laddr, Raddr, Status
FROM netstat()
WHERE Raddr.IP =~ '^(10\.20\.30\.|192\.168\.3\.)'

SELECT conns.Pid AS Pid,
       conns.Name AS NetstatName,
       conns.Laddr.String AS LocalEndpoint,
       conns.Raddr.String AS RemoteEndpoint,
       conns.Status AS ConnStatus,
       proc.Exe AS ProcessPath,
       proc.CommandLine AS CommandLine,
       proc.Username AS ProcessUser
FROM conns
JOIN (
    SELECT Pid, Exe, CommandLine, Username
    FROM pslist()
) AS proc
ON conns.Pid = proc.Pid

Remediation Script

Because there is no endpoint patch to push to the controllers from a workstation, the most valuable scriptable action is verifying your segmentation posture — confirming that only authorized hosts can reach the controller VLAN and that inter-VLAN filtering is actually enforced. This Bash script audits a Linux-based OT firewall/jump host (adapt ACLs for your platform) and validates that unauthorized source ranges cannot reach the controller segment on cyclic communication ports.

#!/bin/bash
# CVE-2026-13584 compensating-control audit
# Verifies segmentation between IT/general VLANs and the MELSEC MX-R control segment.
# Run on the OT firewall or a management host with ruleset visibility. Tested on nftables-based systems.

CTRL_SUBNET="192.168.3.0/24"      # MELSEC MX-R control segment
CTRL_PORTS="45237,45238"          # CC-Link IE family cyclic ports; adjust to documented values
AUTHORIZED_SRC="10.50.10.0/28"    # Engineering workstation management VLAN
FAIL=0

echo "[*] Auditing firewall policy for controller segment protection..."

# 1. Confirm an explicit allow exists ONLY for authorized sources
if nft list ruleset 2>/dev/null | grep -q "$AUTHORIZED_SRC.*$CTRL_SUBNET"; then
  echo "[+] Found explicit allow rule for authorized engineering VLAN -> controller segment."
else
  echo "[!] MISSING: No explicit allow scoped to $AUTHORIZED_SRC -> $CTRL_SUBNET. Verify intended design."
  FAIL=1
fi

# 2. Confirm a default-deny for all other sources to the controller ports
if nft list ruleset 2>/dev/null | grep -Eq "drop.*$CTRL_SUBNET|reject.*$CTRL_SUBNET"; then
  echo "[+] Default-deny present for traffic destined to controller segment."
else
  echo "[!] FAIL: No drop/reject rule protecting $CTRL_SUBNET. Flat-path exposure likely."
  FAIL=1
fi

# 3. Confirm logging is enabled on denied traffic to the controller segment (detection feed)
if nft list ruleset 2>/dev/null | grep -q "log.*$CTRL_SUBNET"; then
  echo "[+] Logging enabled on controller-segment rules (feeds SIEM hunt)."
else
  echo "[!] WARNING: No logging on controller-segment rules. Enable to support Sentinel KQL hunts."
fi

# 4. Check for promiscuous-mode interfaces on this host (unexpected on a firewall — sniffing indicator)
PROMISC=$(ip link show | grep -c PROMISC)
if [ "$PROMISC" -gt 0 ]; then
  echo "[!] WARNING: $PROMISC interface(s) in promiscuous mode. Investigate — not expected on this host."
fi

# 5. Report hosts currently holding sessions to the controller segment
echo "[*] Active sessions to controller segment (review for unauthorized sources):"
ss -tn state established dst "$CTRL_SUBNET" 2>/dev/null | head -20

if [ "$FAIL" -ne 0 ]; then
  echo "[RESULT] Segmentation gaps detected. Remediate before treating CVE-2026-13584 exposure as mitigated."
  exit 1
else
  echo "[RESULT] Segmentation controls verified. Continue monitoring per advisory guidance."
  exit 0
fi

Remediation

Primary action — apply the vendor fix when released. Track the Mitsubishi Electric advisory referenced in ICSA-26-211-07 Update A (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07) and the Mitsubishi Electric PSIRT bulletin for patched firmware for the MXR300-16, MXR300-32, and MXR300-64. All versions are listed as affected, so assume your installed base is vulnerable until the vendor confirms otherwise. Stage firmware updates in a test cell before production deployment — standard OT change discipline applies.

Compensating controls (do these now — they mitigate the exploitation prerequisite, not just this CVE):

1. Enforce strict segmentation of the CC-Link IE TSN segment. The vulnerability requires same-segment access. The control network must be a dedicated VLAN with no general-purpose hosts, no guest/maintenance port access without NAC, and a default-deny firewall policy for anything not originating from authorized engineering stations. The audit script above validates exactly this.
2. Lock down physical and switchport access. Enable 802.1X or MAC-based port security on control-network switches. An unused cabinet jack in a production area is the lowest-effort path to "same network segment."
3. Restrict engineering workstation egress. Engineering stations should be the only endpoints permitted to initiate sessions toward controller cyclic-communication ports. Enforce via host firewall and network ACL; alert on violations (Sigma rule 1).
4. Deploy passive OT protocol monitoring. Mirror control-switch traffic to Zeek/Suricata with OT dissectors or a dedicated ICS visibility platform. Alert on: unexpected frame rates on the TSN schedule window, stations appearing on the segment that are not in the approved device inventory, and protocol violations on CC-Link IE TSN traffic. Timing-conditioned attacks are inherently noisy at the frame level — this is where you catch them.
5. Harden remote access paths. If any remote engineering access reaches this segment, route it through a monitored jump host with MFA and session recording. Eliminate direct VPN-to-control-VLAN paths.
6. Baseline and alarm on controller state. Configure your monitoring to alert on controller fault/error state transitions and cyclic communication interruptions — the observable symptom of successful DoS exploitation — so operations and security see it simultaneously.
7. Follow CISA's standing ICS guidance. CISA recommends the standard defense-in-depth posture for this advisory class: minimize network exposure of control devices, isolate control networks from business networks, and use VPNs only as hardened remote-access conduits. These are not boilerplate here — they are the actual mitigation for a same-segment protocol flaw pending a patch.

Verification after patching: Confirm updated firmware revision on each MX-R unit against the vendor advisory, re-run the segmentation audit, and replay your detection rules against known-good engineering traffic to confirm no regression in visibility.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub