The Controller Area Network (CAN) has been adopted in various reliability-critical industrial systems. However, intermittent connection (IC) problems of network cables may worsen system performance and even threaten operational safety. Recently, there have been several studies on diagnosing intermittent open circuit faults, but the intermittent short circuit (ISC) fault diagnosis has not been addressed. In this paper, a novel ISC fault location method for CANs is proposed based on two-port network modeling. First, the CAN network is modeled as a switched system that depends on the states of the sending nodes using a two-port network approach. An equivalent circuit model and a voltage transfer difference function (VTDF) group are derived for each state where one particular node is sending. Second, upon each fault, corresponding direction events are defined by comparing the two VTDF values that are calculated from the voltages collected at network ends. Then, the fault and health domains can be determined by integrating these direction events with the network topology information according to their statistical significance. Third, a bidirectional eviction localization algorithm is developed to identify ISC fault locations based on the fault and health domains. A testbed is constructed, and case studies are conducted to demonstrate that the proposed method can correctly locate the ISC faults in various network topological layouts.