Mitsubishi Electric has added two products to the affected list for CVE-2026-13584, a flaw in its CC-Link IE TSN industrial communication protocol.
In a security notice updated on November 5, the company added the NZ2CT-GN compatible coupler and FR-D800-E inverter; all versions of both models are affected. The revised Mitsubishi advisory lists the two products among the equipment affected by the protocol vulnerability.
The flaw can allow an attacker with access to a CC-Link IE TSN network to send specially crafted packets under specific timing conditions, tamper with communication data including control input and output values, and trigger a denial-of-service condition by interfering with a product’s control function. Mitsubishi assigns CVE-2026-13584 a CVSS v4.0 score of 7.1. The issue is not described as an internet-facing remote flaw; an attacker must already have access to the affected industrial network.
Mitsubishi’s November 5 update adds the NZ2CT-GN and FR-D800-E to the affected-products table but does not identify a patched firmware version. The company’s notice instead lists physical-access restrictions and keeping affected equipment on trusted networks as mitigations. Mitsubishi credited four researchers at Nozomi Networks with reporting the vulnerability.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
