CVE-2026-13584: Mitsubishi Electric MELSEC MX-R Controller DoS Vulnerability — Detection & Mitigation

---
title: Potential CC-Link IE TSN Injection - Anomalous Traffic to Mitsubishi OUI
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential packet injection attempts targeting Mitsubishi Electric controllers by monitoring for high-frequency or irregular traffic to specific MAC OUIs (Mitsubishi: 00:00:0E, 00:E0:3C, 00:90:4C).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.impact
  - attack.t0815
logsource:
  category: network
  product: zeek
  definition: 'fields: https://github.com/Corelight/zeek-specs/blob/master/scripts/base/protocols/conn/main.zeek'
detection:
  selection_mac:
    dst_mac|startswith:
      - '00:00:0E'
      - '00:E0:3C'
      - '00:90:4C'
  selection_anomaly:
    duration|lt: 0.1
    orig_bytes|gt: 100
  condition: selection_mac and selection_anomaly
falsepositives:
  - High-speed normal I/O polling during peak operations
level: high
---
title: Industrial Controller DoS - Sudden Drop in Heartbeat/Integrity Traffic
id: b2c3d4e5-6789-01bc-def2-234567890bcd
status: experimental
description: Detects signs of a Denial-of-Service on Mitsubishi controllers by identifying a sudden cessation of expected protocol traffic (CC-Link IE TSN) followed by a flood of reset packets.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07
author: Security Arsenal
date: 2026/04/18
tags:
  - attack.impact
  - attack.t0814
logsource:
  category: network
  product: any
detection:
  selection_flood:
    protocol|contains: 'TCP'
    destination_port|startswith: '9600' # Common CC-Link port range if encapsulated, adjust per environment
    event_type: 'flow'
  filter_heartbeat:
    connection_state|contains: 'EST'
  timeframe: 30s
  condition: selection_flood and not filter_heartbeat | count() > 100
falsepositives:
  - Network reconfiguration or rapid scanning of the OT network
level: critical

let MitsubishiOUIs = dynamic(["00:00:0E", "00:E0:3C", "00:90:4C"]);
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where DeviceCustomHexString3 in (MitsubishiOUIs) // Assuming DeviceCustomHexString3 maps to Destination MAC in your CEF config
| summarize TotalBytes = sum(SentBytes + ReceivedBytes), PacketCount = count() by DeviceName, SourceIP, bin(Timestamp, 5m)
| where PacketCount > 1000 // Threshold tuning required based on baseline I/O cycle
| project TimeGenerated, DeviceName, SourceIP, PacketCount, TotalBytes
| sort by PacketCount desc

-- Hunt for connections to Mitsubishi Electric MAC OUIs
SELECT
  F.Address AS RemoteAddress,
  F.Port AS RemotePort,
  P.Name AS ProcessName,
  P.Pid,
  P.Cmdline,
  F.State
FROM foreach(row={
    SELECT Pid FROM pslist()
  }, query={
    SELECT
      F.Address,
      F.Port,
      F.State,
      P.Name,
      P.Pid,
      P.Cmdline
    FROM netstat(pid=Pid) AS F
    JOIN pslist() AS P
    ON P.Pid = F.Pid
    WHERE F.State = 'ESTABLISHED'
      AND regex_search(source=parse_string_with_regex(F.Address, '(.{2}):(.{2}):(.{2}):').submatches[0], pattern='^(00:00:0E|00:E0:3C|00:90:4C)$')
      // Note: MAC retrieval in netstat varies by OS; adjust column mapping for Windows/Linux ARP tables if direct mapping not available
})

#!/bin/bash
# Remediation: Enforce Network Segmentation for Mitsubishi MELSEC Controllers
# Usage: sudo ./harden_mitsubishi_segment.sh <controller_subnet>

CONTROLLER_SUBNET=$1
IPTABLES=/sbin/iptables

if [ -z "$CONTROLLER_SUBNET" ]; then
  echo "Usage: $0 <controller_subnet> (e.g., 192.168.10.0/24)"
  exit 1
fi

echo "[*] Applying strict access control for $CONTROLLER_SUBNET..."

# Flush existing rules on the CHAIN (or create a new chain)
$IPTABLES -N MITSUBISHI_CONTROL 2>/dev/null || $IPTABLES -F MITSUBISHI_CONTROL

# Allow traffic from known Engineering Workstations (Replace with actual IP(s))
# Example: Allow only from 10.0.0.50
ENGINEERING_STATION="10.0.0.50"
$IPTABLES -A MITSUBISHI_CONTROL -s $ENGINEERING_STATION -d $CONTROLLER_SUBNET -j ACCEPT

# Allow established/related connections
$IPTABLES -A MITSUBISHI_CONTROL -m state --state ESTABLISHED,RELATED -j ACCEPT

# Explicit DROP for all other traffic to controller subnet (Mitigates CVE-2026-13584)
$IPTABLES -A MITSUBISHI_CONTROL -d $CONTROLLER_SUBNET -j DROP

# Append to FORWARD chain (assuming this gateway routes to OT)
# Check if rule exists to prevent duplicates
if ! $IPTABLES -C FORWARD -j MITSUBISHI_CONTROL 2>/dev/null; then
  $IPTABLES -A FORWARD -j MITSUBISHI_CONTROL
  echo "[+] Rules applied successfully. Access restricted to $ENGINEERING_STATION."
else
  echo "[!] Rules already active."
fi