Robots manipulated via a factory network: the TSN flaw that shatters synchronization

A flaw in the real-time protocol

Research presented by Nozomi Networks at this year's Black Hat USA shows that weaknesses in Time-Sensitive Networking (TSN) protocols can be exploited to modify any process variable on a TSN network. The work, conducted by senior security researcher Luca Cremona, demonstrated how to control robotic arms and alter OT synchronization clocks.

The protocol analyzed is CC-Link IE TSN, a TSN implementation developed by Mitsubishi Electric and one of the most widespread in industrial automation. The flaw was reported in a CISA advisory dated July 30, 2026, identified as ICSA-26-211-07. Mitsubishi Electric completed the acquisition of Nozomi Networks in January 2026, in a deal worth approximately one billion dollars. Nozomi operates as a wholly owned but independent subsidiary, with a vendor-neutral roadmap.

Neither the research nor the advisory indicates a specific version of the protocol: the weakness resides in the protocol itself. For the Phoenix Contact TSN switches involved in a second set of vulnerabilities, the exact models were not listed publicly.

TSN precision and the similarity to GOOSE

TSN is a family of relatively new timing protocols, born as a set of amendments to IEEE bridging specifications. The goal is to provide deterministic communication over standard Ethernet in industrial automation. The problem it solves is critical: when OT safety signals and synchronized control messages share the same Ethernet infrastructure with best-effort IT traffic, collisions can cause unplanned shutdowns with physical consequences in plants.

Critical messages must be delivered within microseconds between controllers and field devices. If they do not arrive on time, watchdog timers trigger and machines go into protective shutdown. TSN assigns absolute priority to the most critical flows, such as emergency stop button signals, which must pass at all costs even when the network is congested.

During the analysis, Cremona noticed a similarity between CC-Link IE TSN and the GOOSE protocol, used in power distribution and known for predictable timing sequence issues. By reproducing attack techniques already used against GOOSE, the team reverse-engineered the synchronization behavior of CC-Link IE TSN. They were able to predict valid values and manipulate cyclic I/O signals.

Frame injection in the right time slot

The vulnerability allows injecting specially crafted frames into the correct time slot, making them accepted as legitimate scheduled communications. To exploit it, access to the TSN network is required, normally not exposed externally. From there, the team stress-tested Phoenix Contact TSN switches, discovering bugs that allow reaching the process port from the remote management interface used by engineers.

The most important entry point is the management interface of the TSN switch. It may be exposed on a wider network or reached from a fake or tampered device close to the network. Once access to that interface is obtained and if the switch is vulnerable, the attacker has control. Although CC-Link IE TSN has a security model and optional cryptographic protection of user data, shortcomings in Layer 2 defenses offer a simpler path to inject traffic into the communication flow.

Physical consequences: robots, grippers and silent drifts

The impact goes beyond reading data. The research demonstrates the ability to modify any process variable on the TSN network. The most impactful scenario shown involves starting and stopping robotic arms, opening grippers and dropping transported objects.

There are also silent attacks. The subtle alteration of OT synchronization clocks can introduce small, almost imperceptible offsets. The effects on process scheduling only manifest after some time and make it difficult to trace the moment of the attack. Physical consequences in industrial plants include sudden shutdowns, tampering with safety-critical processes and loss of control over machinery.

Defenses and remediation: what to do now

In the short term, the recommendation is to keep the firmware of all OT network devices up to date. A firmware patch is already available for the management interface flaws in Phoenix Contact TSN switches. Network segmentation remains the most effective defense at present: TSN networks must be kept well separated, preventing attackers from jumping from one network to another without proper authorization.

Nozomi is collaborating with parent company Mitsubishi Electric on long-term remediation of the underlying TSN weakness. They are evaluating the addition of cryptographic primitives to protect the network and prove that messages come from the correct sender. The challenge is the tension between performance and security: adding encryption to a system that requires sub-microsecond timing precision is complex, but initial tests indicate that the proposed cryptographic solution is feasible.

The research is limited to a single TSN protocol, but is considered a starting point for the industry. The goal is to analyze weaknesses in other protocols that rely on TSN primitives. The recorded Black Hat session remains available on-demand for attendees until September 14.