For awareness Medium Check exposure in your normal cycle
Updated Mitsubishi Electric advisory on CC-Link IE TSN tampering and denial-of-service flaw
Mitsubishi Electric PSIRTMitsubishi Electric · manufacturing
What happened. Mitsubishi Electric updated its advisory on a flaw in the CC-Link IE TSN industrial communication protocol that allows information tampering and denial of service. The feed gave no body text, so no details are available.
Who is affected. Users of Mitsubishi Electric products that use the CC-Link IE TSN protocol, in sectors such as manufacturing. The source names no products or versions.
What to do. Check the Mitsubishi Electric advisory for the affected products and versions, and check whether you use CC-Link IE TSN.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
- L1
Why: CC-Link IE TSN links controllers and field devices on the control network, which places it at the controller level (L1) and the supervisory level (L2).
- Are you exposed?
Check your asset inventory for Mitsubishi Electric devices on CC-Link IE TSN and compare them with the products listed in the advisory.
- If you cannot fix it yet
- Keep CC-Link IE TSN networks isolated from the corporate network and the internet.
- Restrict access to the control network to known devices and engineering hosts.
- Watch for
- Look for unexpected or malformed traffic on CC-Link IE TSN segments.
- Look for devices dropping off the network or stopping communication without a known cause.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Mitsubishi Electric PSIRT (opens mitsubishielectric.com)
More on Mitsubishi Electric Manufacturing