# Malformed UDP Packet Can Knock Out Mitsubishi Electric Factory Automation Networks
## The Threat
A vulnerability in Mitsubishi Electric's CC-Link IE TSN industrial networking stack lets a remote attacker bring down factory automation modules with a single malformed UDP packet. No credentials required, no prior access needed — just network reachability to the affected device. The result is a denial-of-service condition, a timeout error, or a communication delay severe enough to disrupt real-time industrial control traffic.
CC-Link IE TSN is a time-sensitive networking protocol designed for deterministic, high-speed communication across factory floors — the kind of link that coordinates robot arms, conveyor systems, and process control loops. When these modules go silent or lag, production lines stall. In process manufacturing environments, unexpected communication delays can mean more than downtime; they can trigger unsafe conditions in equipment that depends on precise, continuous I/O.
What makes this advisory particularly notable is the sheer breadth of affected hardware. This isn't one module with a bad firmware version — it's a sweeping vulnerability across Remote I/O modules, analog/digital converters, FPGA modules, communication LSIs, and MELSEC iQ-R series master modules. The common thread is the CC-Link IE TSN network stack itself, which suggests the flaw lives at the protocol handling layer rather than in any single device's application code. This is the fourth update to the advisory, indicating Mitsubishi Electric has been progressively discovering additional affected product lines since initial disclosure.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2025-3511 |
| CVSS v3.1 Score | 7.5 (High) |
| Vector String | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Impact | Availability (DoS, timeout, communication delay) |
| CWE | CWE-400 — Uncontrolled Resource Consumption |
## Affected Products
CC-Link IE TSN Remote I/O Modules — firmware ≤ 09
CC-Link IE TSN Analog-Digital Converter Modules — firmware ≤ 07
CC-Link IE TSN Digital-Analog Converter Modules — firmware ≤ 07
CC-Link IE TSN FPGA Modules — firmware 01
CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY — firmware ≤ 1.08J
MELSEC iQ-R Series CC-Link IE TSN Master/Local Modules
## Mitigations
Mitsubishi Electric has released updated firmware for affected products. Organizations should prioritize patching based on network exposure:
## References
---
## HackWire Analysis
This advisory deserves more attention than the typical ICS DoS disclosure — not because the vulnerability is technically exotic (it isn't), but because of what it reveals about the attack surface that's quietly accumulated in modern industrial networks.
CC-Link IE TSN was adopted precisely because it supports real-time, deterministic communication over standard Ethernet. That architectural choice — running over commodity networking infrastructure — is what enables interoperability and reduced cost. It's also what makes UDP spoofing a viable remote attack path against modules that, a decade ago, would have required physical proximity to touch. The tradeoff was always there; this vulnerability just makes it explicit.
The "Update D" designation should alarm asset owners. When a vendor revises an advisory four times, it's almost always because the scope was larger than initially disclosed — more firmware branches, more hardware variants, more affected product lines than the initial triage surfaced. The implication: if you ran the first advisory past your asset inventory and came up clean, run it again with the expanded product list.
The availability-only impact classification can lull defenders into treating this as lower priority than a code execution bug. That framing is wrong for ICS. In process control and discrete manufacturing, availability *is* safety. A module that stops responding mid-cycle doesn't just pause production — it can leave actuators in undefined states, trigger emergency shutdowns, or worse, allow a process to continue without the feedback loop that was keeping it bounded. The risk calculus here is fundamentally different from enterprise IT, and security teams that treat a CVSS 7.5 availability-only ICS bug the same way they'd treat a web app DoS are miscalibrated.
Defenders in automotive, semiconductor, and food & beverage manufacturing — all heavy CC-Link IE TSN adopters — should treat this as urgent, not routine.
— HackWire Editorial
---
## Related Coverage