As reported by CISA in advisory ICSA-25-128-03 (Update D, August 27, 2026), Mitsubishi Electric has issued another revision covering a persistent denial-of-service vulnerability affecting a wide range of CC-Link IE TSN Remote I/O modules. The fact that this advisory is now on its fourth update signals that affected organizations are still struggling with visibility and remediation across distributed industrial deployments.
Vulnerability Overview
| CVE | Severity | Attack Vector | Impact | Exploitation |
|---|---|---|---|---|
| CVE-2025-3511 | High (CVSS 7.5) | Network — unauthenticated UDP | DoS, timeout errors, communication delays | No confirmed in-the-wild exploitation reported |
Affected Products
All affected devices are Mitsubishi Electric CC-Link IE TSN Remote I/O modules with firmware version 09 or earlier. The advisory enumerates more than 20 distinct SKUs across the NZ2GN2S1, NZ2GN2B1, NZ2GNCF1, NZ2GNCE3, and NZ2GN12A4 / NZ2GN12A2 / NZ2GN12A42 families. The breadth of affected part numbers is the real story here — a single production line may deploy several variants, each requiring independent firmware verification.
Patch Availability
Mitsubishi Electric has made updated firmware available. Customers should consult the vendor's security bulletin for specific upgrade instructions, as firmware installation on I/O modules typically requires a planned maintenance window and may involve controller-side configuration changes.
Why This Matters
The vulnerability is exploitable by sending a specially crafted UDP packet — no authentication required. In a converged IT/OT environment where TSN (Time-Sensitive Networking) segments are reachable from broader plant networks, an attacker who gains even low-level network access can disrupt I/O communication. The impact envelope — DoS, timeout errors, and communication delays — is particularly dangerous for processes relying on deterministic cyclic data exchange. A communication delay in a safety-critical loop can be as consequential as a full outage.
This is the fourth advisory update, which strongly suggests that asset owners are having difficulty completing remediation. Common blockers in OT patching — maintenance windows, production downtime cost, and incomplete asset inventories — are likely in play.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and prioritize. Enumerate every CC-Link IE TSN I/O module across all sites. Cross-reference firmware versions against the advisory's affected list — do not assume a single SKU represents your exposure.
- Apply firmware updates to version 10 or later per Mitsubishi Electric's guidance. Schedule maintenance windows for production lines with high I/O density.
- Restrict UDP reachability. Until patching is complete, ensure CC-Link IE TSN segments are isolated from plant and enterprise networks using VLAN segmentation, ACLs, or OT firewalls. Only required protocols and ports should traverse boundaries.
- Deploy network detection. Monitor for anomalous UDP traffic directed at TSN I/O module IP ranges. Crafted single-packet DoS attempts are often low-volume and can be flagged by unusual source addresses or packet sizes.
- Validate safety interlocks. Confirm that communication-loss behavior for affected modules fails safe — review PLC watchdog timers and emergency stop logic to ensure a DoS condition cannot cause unsafe actuation.
Longer-Term
Organizations should treat this as a catalyst to build a firmware-level OT asset inventory. The SKU sprawl in this advisory is a warning: without automated discovery of device models and firmware versions, future ICS advisories will continue to outpace remediation efforts.
The fourth update to this advisory is not a sign of vendor negligence — it is a sign that the OT community still lacks the asset visibility needed to close these gaps quickly. Fix the inventory problem and the patching problem becomes tractable.
