Short Takes – 6-20-24

Hydroxide-loaded sponge soaks up atmospheric carbon dioxide. ChemistryWorld.com article. May be more useful for other, point-source atmospheric scrubbing applications. Pull quote: “García points out that the adsorption capacity of the charged sponges is ‘approximately one fourth of the uptake reported for current benchmarks’, including amines. Moreover, the capture capacity is almost halved if humidity increases from 10 to 40%, which would be problematic if capturing carbon dioxide in climates with high humidity, for example in the UK where the average humidity is over 70%. ‘Such problematic performance could also hugely hinder applications in point-source carbon capture, [where] gas streams are normally saturated in water,’ explains García López. However, she sees the tuneability, quick kinetics, and simple preparation of the system as major benefits. ‘The method has a huge potential to achieve very good results in the future,’ she adds.”

Electronic Weapons: SpaceX Stifles Russian Use of Starlink. StrategyPage.com article. Pull quote: “Early in the war American defense officials admitted that if the Starlink satellite internet service were government run, it would not have remained operational over Ukraine because government regulations do not allow for the quick responses Starlink management used to defeat Russian electronic attacks and keep Starlink operational in Ukraine.”

Titan Disaster Forces Global Rethinking of Deep Sea Exploration. NYTimes.com article. Pull quote: ““It has to be mandatory,” Alfred S. McLaren, a retired Navy submariner, submersible pilot and president emeritus of the Explorers Club, said of the proposed upgrade. “Until you get these testing and certification rules in place, it’s a wide open sea, and stupid things are going to happen.””

Mathematicians Are Suddenly Rethinking the Equal Sign. PopularMechanics.com article. Slightly geeky, but may have implications outside of academia. Pull quote: “If that sounds like overthinking, you’re right—using the highly intuitive and context-adapting human mind, we can do it pretty much without thinking at all. But math is an abstract field of study, and computer programming is arguably even more so. The machines we rely on to solve complicated problems need a lot more direction than our flexible human minds, and Buzzard’s career project is converting human-written math proofs into all of the algorithmic steps that are required to code them with a computer.”

Safety Fitness Determinations; Virtual Public Listening Sessions. Federal Register FMCSA virtual meeting notice. Summary: “FMCSA announces that it will host two virtual public listening sessions pertaining to development of an updated methodology to determine when a motor carrier is not fit to operate commercial motor vehicles in or affecting interstate commerce. Specifically, the Agency would like to hear from members of the public on issues of concern relating to the current Safety Fitness Determination (SFD), including, for example, the three-tiered rating system (Satisfactory, Unsatisfactory, Conditional) versus changing to a proposed single rating only when a carrier is found to be Unfit; utilizing inspection data and FMCSA's Safety Measurement System (SMS); incorporating driver behavior into SFD ratings; and revising the list of safety violations used to calculate the rating, and adjusting the weights allocated to particular violations including increasing the weight for unsafe driving violations.” First meeting date: June 25^th, 2024.

Massive underwater drone skates off California coast. Axios.com article. Extremely sparse language. Pull quote: “The drone is modular, meaning it is easily taken apart and reassembled in the field. The Manta Ray prototype was shipped cross-country in pieces for at-sea assessments earlier this year.”

Review – 3 Advisories Published – 6-20-24

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Westermo, CAREL, and Yokogawa.

Advisories

Westermo Advisory - This advisory describes three vulnerabilities in the Westermo L210-F2G industrial ethernet switches.

CAREL Advisory - This advisory describes a path traversal vulnerability (with known exploit) in the CAREL Boss-Mini, a local supervisor solution.

Yokogawa Advisory - This advisory describes an improper access control vulnerability in the Yokogawa CENTUM distributed control system.

 

For more information about these advisories, including links to exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-6-20-24 - subscription required.

CISA CSAT Breach Update – 6-20-24

Earlier this afternoon, CISA provided an email to registered recipients providing the following updates to their CSAT Breach notification. This latest notification notes that:

“This announcement applies to all facilities registered with the CFATS program. Direct email notification is being made to individual facilities’ CSAT Authorizers and Cyber Security Officers, if designated, in batches; we anticipate that all registered Authorizers and Cyber Security Officers will receive this notification by Monday, June 24. If you have additional questions, please contact us at CFATS.Notifications@cisa.dhsg.gov or CFATS@hq.dhs.gov.”

The terminology “all facilities registered with the CFATS program” almost certainly means any facility that has registered a facility Authorizer in preparation for submitting a Top Screen, whether or not a Top Screen was ever submitted. It is certainly not limited to facilities that have been notified that they were a covered facility under the Chemical Facility Anti-Terrorism Standards (CFATS) program.

CISA Announces CSAT Breach

As if the CFATS program did not have enough problems, today CISA announced that there was a cybersecurity breach of their Chemical Security Assessment Tool (CSAT) in January of this year. The notice states that:

“While CISA’s investigation found no evidence of exfiltration of data, this intrusion may have resulted in the potential unauthorized access of Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety Program (PSP) submissions, and CSAT user accounts.”

CISA has directly contacted individuals with CSAT accounts to notify them of the breach.

CISA has scheduled two webinars to discuss the breach, its potential consequences, and actions facilities should take as a consequence of the breach. Webinars will be held on June 24^th, 2024 and July 9^th, 2024 (links are to registration pages).

There is an interesting notification problem associated with this potential breach, there is a possibility that that individuals who had been vetted via the CFATS personnel surety tool may have had their data exposed during the breach. CISA does not have access to the contact information for these individuals so cannot make the necessary breach notifications. CISA thus notes that:

“CISA is thereby requesting, on a voluntary basis, that facilities that received the CSAT Ivanti Notification Letter notify individuals submitted by that facility for vetting under the CFATS Personnel Surety Program of this incident. Download a template letter that facilities can use to notify personnel. Alternatively, should facilities decline to notify these individuals, CISA requests that facilities provide CISA with the contact information for individuals submitted under the CFATS Personnel Surety Program on a voluntary basis so that CISA can notify impacted individuals. Facilities can send contact information for personnel that had Personally Identifiable Information (PII) submitted for vetting under CFATS Personnel Surety Program to CFATS.Notifications@cisa.dhs.gov.”

The announcement has a brief frequently asked question section that addresses the following questions:

• How was this compromise identified?

• What actions did CISA take to address the compromise?

• If CISA does not have any evidence of data exfiltration, why are notifications being sent?

• Where can I get more information on this cybersecurity incident?

• As a facility official, who do I contact if I have more questions about this incident?

• As a potentially impacted individual, who do I contact if I have more questions?

• Who is eligible for identity protection based on this compromise?

• How do I apply for identity protection?

• Why is identity protection not available to me?

• What data was collected in the CFATS Top-Screen survey?

• What data was collected in the Security Vulnerability Assessment (SVA)?

• What data was collected in the Site Security Plan/Alternative Security Program (SSP/ASP)?

• What data was collected in the Personnel Surety Program?

Bills Introduced – 6-18-24

Yesterday, with the Senate in Washington and the House meeting in pro forma session, there were 67 bills introduced. Two of those bills may receive additional attention in this blog:

HR 8775 To require an assessment on manual operations for critical infrastructure, and for other purposes. Crenshaw, Dan [Rep.-R-TX-2]

S 4572 A bill to direct the Secretary of Commerce, acting through the Assistant Secretary of Commerce for Communications and Information, to conduct a study of the national security risks posed by consumer routers, modems, and devices that combine a modem and router, and for other purposes. Blackburn, Marsha [Sen.-R-TN]

I will be covering HR 8775.

I will be watching S 4572 for language and definitions that would specifically include the consideration of industrial control system in critical infrastructure operations as part of the ‘national security risks’ to be included in the scope of the study required by this bill

Mention in Passing

I would like to mention in passing one space-technology bill introduced yesterday:

HR 8787 To establish a demonstration program for the active remediation of orbital debris and to require the development of uniform orbital debris standard practices in order to support a safe and sustainable orbital environment, and for other purposes. Neguse, Joe [Rep.-D-CO-2] 

As the number of commercial space launches continues to increase, the problem of space debris is going to be an even larger problem as time progresses. It will be interesting to see how the bill intends to fund the demonstration program.

Review - OMB Approves Three PHMSA Hazmat ICR Revisions

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a total of 12 information collection request (ICR) renewals for various hazardous materials related collections from the DOT’s Pipeline and Hazardous Materials Safety Administration (PHMSA). Three of these ICR renewals included significant changes to the information collection burden estimates due to recent regulatory updates.

The three revised ICR’s are:

2137-0034 Hazardous Materials Shipping Papers & Emergency Response Information,

2137-0051 Rulemaking, Special Permits, and Preemption Requirements, and

2137-0557 Approvals for Hazardous Materials,

 

For more details about these ICR revisions, including the revised burden estimates and the reasons for the change, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/omb-approves-three-phmsa-hazmat-icr - subscription required.

 

Short Takes – 6-18-24

Orcas are eating sharks in the Gulf of California — and it may be happening more than we think, experts say. LiveScience.com article. Pull quote: “However, the recent increase in observations doesn't necessarily mean these hunts are happening more. It could be that modern technology, like drones and underwater cameras, is making it easier to spot and record the predation.”

A Bird-Flu Pandemic in People? Here’s What It Might Look Like. NYTimes.com article (free). Pull quote: ““I think the virus is clearly changing its property, because we never saw outbreaks in cows,” Dr. Kawaoka said. Conjunctivitis, also known as pink eye and the primary symptom in two of the three farmworkers, is not typical of H5N1 infection. The appearance of the virus in mammary glands — in cattle and even in non lactating mice — was also unexpected.”

NASA, Boeing Update Starliner Crew Flight Test Return from Station. Blogs.NASA.gov blog post. Pull quote: “Teams from NASA and Boeing now are targeting no earlier than 10:10 p.m. EDT Tuesday, June 25, for the undocking of the Starliner spacecraft from the International Space Station. For the primary undocking opportunity, NASA astronauts Butch Wilmore and Suni Williams, the first crew to fly aboard Starliner, would land about 4:51 a.m. on Wednesday, June 26, at White Sands Space Harbor in New Mexico.”

CSB Provides an Update on their Dow Louisiana Operations Explosions Investigation 6-18-24

Today the Chemical Safety Board (CSB) published an update about the progress of their Dow Louisiana Operations Explosions investigation. This is one of four investigations listed on the Boards Current Investigations page. Investigations announced earlier this month at facilities at Geismar, LA and Chattanooga, TN have not yet been added to that page.

The update reports that the “CSB is continuing to gather facts and analyze several key areas involved in this incident,” including:

• Emergency pressure-relief systems scenarios,

• Reactive chemical hazards,

• Reactive material emergency pressure-relief system design,

• Maintenance procedures and practices, and

• Relevant facility, corporate, and industry standards

Review - Chemical Terrorism Threats Report

The National Academies Press has released a pre-publication version of Consensus Study Report commissioned by the Department of Defense on “Chemical Terrorism: Assessment of U.S. Strategies in the Era of Great Power Competition”. Mandated by §1299I, Assessment of weapons of mass destruction terrorism, of the 2021 National Defense Authorization Act (134 STAT. 4011, PL 116-283), the study is “focused on identifying the most important technical, policy, and  resource gaps with respect to strategies for identifying, preventing, countering, responding to,  and budgeting for chemical threats and attacks against U.S. interests.” (pg 15)

The National Academies of Sciences, Engineering, and Medicine (NASEM) Committee was charged with addressing “the adequacy of strategies to prevent, counter, and respond to chemical terrorism, and identify technical, policy, and resource gaps” with respect to:

• Identifying national and international chemical risks, and critical emerging threats,

• Preventing state-sponsored and non-state actors from acquiring or misusing the technologies, materials, and critical expertise needed to carry out chemical attacks, including dual-use technologies, materials, and expertise,

• Countering efforts by state-sponsored and non-state actors to carry out such attacks,

• Responding to chemical terrorism incidents to attribute their origin and help manage their consequences,

• Budgets likely to be required to implement effectively such strategies, and

• Other important matters that are directly relevant to such strategies.

As one would expect with any study on counter chemical terrorism in the United States commissioned before July 27^th, 2023, this report includes specific discussions about the Chemical Facility Anti-Terrorism Standards (CFATS) program that expired on that date.

CFATS related discussions in the report can be found in sections on:

• Chemical Substitution,

• Insider Threat,

• Report Recommendations

Commentary

While this document is an important discussion in it’s own right, it should also provide a serious, outsider perspective on the need to reinstate the Chemical Facility Anti-Terrorism Standards (CFATS) program. It should be used to disabuse anyone of the supposed problem the CFATS program is duplicative and unnecessary. In fact, this report makes the point that the program should be expanded in its scope.

 

For more information on the CFATS discussions in the report, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/chemical-terrorism-threats-report - subscription required.

Review – 1 Advisory Published – 6-18-24

Today, CISA’s NCCIC-ICS published a control system security advisory for products from RAD Data Communications.

Advisories

RAD Advisory - This advisory describes a directory traversal vulnerability (with known exploit) in the RAD SedcFlow-2 ethernet switch/router.

 

For more information on this advisory including a brief look at the delay between the detection of the vulnerability and the exploit publication, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-published-6-18-24 - subscription required.

Short Takes – 6-18-24 – Space Geek Edition

Warp drives could generate gravitational waves. Phys.org article. Pull quote: “If they've figured out how to construct and use a warp drive, even with all of its seeming impossibilities, their activities might create gravitational waves that our future observatories could detect, even in other galaxies. But for now, it's all theoretical.”

Things that almost go boom. SpaceReview.com article. An interesting story from the history of rocket science. Pull quote: “Every organization eventually learns the lesson of systems engineering. They learn that one part of a complex machine can affect another part in unforeseen ways. They learn that someone has to be responsible for the entire system and aware of its individual components so that they do not interfere with each other. And they learn that communication, and procedures for communicating, are important for success. The earlier they learn this lesson the better. Skip it and rockets blow up.”

The rush to return humans to the Moon and build lunar bases could threaten opportunities for astronomy. TheSpaceReview.com article. Nice discussion about potential astronomic observations from the Moon. Pull quote: “In 2024, the International Astronomical Union put together the working group Astronomy from the Moon to start defining which sites astronomers want to preserve for their work. This entails ranking the sites by their importance for each type of telescope and beginning to talk with a key United Nations committee. These steps may help astronomers, astronauts from multiple countries and private interests share the Moon.”

Astroscale’s space junk inspection satellite snaps a close-up photo of a discarded rocket stage. TechCrunch.com article. Interesting photo, I wonder how good their best pictures were. Pull quote: “In addition to the images, ADRAS-J is also collecting data on the object, like its spin rate and the overall condition of the structure. In the next phase of the mission, Astroscale is aiming to execute even more controlled close approach maneuvers, including flying around the object, to capture additional images of the upper stage. At the end of the mission, ADRAS-J will transition to a safe orbit to avoid collision with the piece of space junk.”

HyImpulse Signs Agreement to Launch SL1 Rocket From Australia. EuropeanSpaceFlight.com article. Pull quote: “On 6 June, Southern Launch announced that it had signed a Memorandum of Understanding with HyImpulse for the launch of additional SR75 missions from Koonibba. The agreement also included provisions for the pair to explore the possibility of launching orbital flights aboard the HyImpulse SL1 rocket from Whalers Way Orbital Launch Complex on the south coast of Australia.”

Starliner’s Return Delayed Again: What’s Next for the Spacecraft? SciTechDaily.com article. Pull quote: “NASA and Boeing teams also prepared plans for Starliner to fire seven of its eight aft-facing thrusters while docked to the station to evaluate thruster performance for the remainder of the mission. Known as a “hot fire test,” the process will see two bursts of the thrusters, totaling about a second, as part of a pathfinder process to evaluate how the spacecraft will perform during future operational missions after being docked to the space station for six months. The crew also will investigate cabin air temperature readings across the cabin to correlate to the life support system temperature measurements.”

Bills Introduced – 6-17-24

Yesterday, with just the Senate in session, there were 13 bills introduced. Three of those bills will receive some attention in this blog:

HR 8772 Legislative Branch Appropriations Act, 2025 Valadao, David G. [Rep.-R-CA-22]

HR 8773 Making appropriations for financial services and general government for the fiscal year ending September 30, 2025, and for other purposes. Joyce, David P. [Rep.-R-OH-14] 

HR 8774 Department of Defense Appropriations Act, 2025 Calvert, Ken [Rep.-R-CA-41] 

It is unusual for the House to allow introduction of bills when the body is not in session, the most frequent exceptions to that rule are spending bills.

I do not typically find much to cover in the Legislative Branch or FinServices spending bills, but oddities to arise from time to time in the amendment process.

Short Takes – 6-17-24

Leadership: Corruption Cripples The Russian Military. StrategyPage.com article. Pull quote: “The recent arrests, prosecutions and imprisonment of senior officials who were corrupt, or too obviously corrupt, has sent a message to all senior officials in jobs giving them access to the swollen defense budget that is now 6.7 percent of GDP. Before the invasion it was 3.6 percent. Putin thought the invasion would quickly overthrow the Ukrainian government. That did not happen and the costs of that war are more than Russia can afford. This is nothing new, it was decades of spending 15 percent of GDP on defense, and tolerating a lot of corruption by senior officials, that caused the Soviet Union to collapse in 1991. Many Russian economists and bankers believe another economic collapse, similar to what destroyed the Soviet Union, is possible unless the increased defense spending is restrained along with the growing corruption.”

Prospects for orbital data centers. SpaceReview.com article. Pull quote: “Terrestrial high-performance compute is heavy, primarily because of liquid thermal control systems. These need to be optimized. A continued reduction in space launch costs, coupled with advances in lightweight power and thermal management solutions, will be the key factors to watch in making orbital data centers practical.” Robot maintenance or people in space?

Power And Tension: The Cyber Security Problems of Military Electrification. WarOnTheRocks.com article. Not just about ‘electric vehicles’ but also about connected vehicles. Pull quote: “The challenge for the defender, however, is to set the bar high enough from the outset to restrict the adversary’s freedom of maneuver as much as possible. As militaries find themselves in the global planning phase of electrification, now is the time to meaningfully consider the cyber security of future military vehicles.”

This startup wants to find out if humans can have babies in space. TechnologyReview.com article. A tad bit of a click-bait headline. Pull quote: “But experiments on reproduction do not necessarily need to involve human samples. Jeffrey Alberts wants to see several generations of animals like rats be born in space, live their entire lives there, and reproduce. Such experiments have never been performed and would be the definitive test of whether there are any multigenerational effects of life in space—an outstanding question highlighted by the National Academies report.”

First tropical storm watch of the season issued for South Texas and Mexico. TheHill.com article. Pull quote: “A coastal flood watch was also issued for the entire Texas coast, as was an advisory in Louisiana and Mississippi. Forecasters noted that coastal Texas cities could see between 8-12 inches of rain this week, while parts of northern Mexico could see multiple feet.”

Review - HR 8197 Introduced – CBWC Sanctions

Last month, Rep Banks (R,IN) introduced HR 8197, the Countering Beijing’s Weaponization of Fentanyl Act. The bill would make various revisions to the Chemical and Biological Weapons Control and Warfare Elimination (CBWCE) Act of 1991 to make the international distribution of fentanyl or its precursors by a country an act of chemical or biological warfare which would require the imposition of Presidential sanctions. No new funding is authorized by this bill.

Moving Forward

Banks is not a member of the House Foreign Affairs Committee to which this bill was assigned primary consideration. This means that there is little chance that there is sufficient influence to see the bill considered in Committee. I suspect that there would be limited, partisan support, for opening this can of worms in that Committee. Broader support would be likely if the bill were to make it to the floor of the House.

Commentary

This bill would, if passed into law, water down the importance of the CBWCE by effectively making it a drug trafficking bill. Having said that, the sanctions that the bill would require and allow the President to impose would certainly seem to be appropriate, though I am not sure how effective they would be against China. I think this bill would be more effective if it were rewritten as a stand-alone measure with no reference to the CWBCE. It should also be expanded to include such drugs as heroin and cocaine.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-8197-introduced - subscription required.

Review – Public ICS Disclosures – Week of 6-8-24 – Part 3

For Part 3 we have 53 researcher reports for products from Cinterion, Deep Sea Electronics (6), Delta Electronics (41), Luxion (2), Advantech, Schneider, and ZKTeco. We have one exploit for products from Zyxel. Finally, I would like to briefly mention a journal article: “On the cybersecurity of smart structures under wind”.

Researcher Reports

Advantech Report - The Zero Day Initiative published a report that describes a disclosure of sensitive information vulnerability in the Advantech iView network management tool.

Cinterion Report - Kaspersky Labs published a report that describes seven vulnerabilities in multiple Cinterion modems.

Deep Sea Electronics Report - ZDI published six reports describing vulnerabilities in the Deep Sea Electonics DSE855 USB to Ethernet Communications Device.

Delta Electronics Reports - ZDI published 43 reports (ZDI-24-620 through ZDI-24-663) about vulnerabilities in the Delta Electronics CNCSoft-G2.

Luxion Reports - ZDI published two reports about vulnerabilities in the Luxion KeyShot product.

Schneider Report - ZDI published a report describing an exposed dangerous method vulnerability in the Schneider APC Easy UPS Online application.

ZKTeco Report - Kaspersky published a report describing six vulnerabilities in products from ZKTeco.

Exploits

Zyxel Exploit - UB3RSICK published a Metasploit module for an OS command injection vulnerability (that is listed in CISA’s Known Exploited Vulnerability Catalog) in Zyxel’s firewall products.

Articles

Structural Cybersecurity – This week Miguel Cid Montoya (et al) published an article in the Journal of Wind Engineering and Industrial Aerodynamics: “On the cybersecurity of smart structures under wind”.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-a4f - subscription required.

Short Takes – 6-15-24 –

Eyeing Trump presidency, conservatives want to delay funding fight. TheHill.com article. Pull quote: ““I [Rep Cole, R,OK] was around here in 2017 when we tried that, and we had the House, the Senate, obviously President Trump won,” he said. But Republicans still “did not have more leverage because you still have the filibuster in the United States Senate.”

The Dairy Industry Must Act Faster to Keep H5N1 from Starting a Human Epidemic. ScientificAmerican.com commentary. Pull quote: “H5N1 has taken off much faster than we, as a country, could mobilize. It is vital not to dwell on these missteps but rather to work with industry veterinarians and human and animal health regulatory agencies to devise transparent policies and practices to control this disease.”

How Much Does ‘Nothing’ Weigh? ScientificAmerican.com article. Geeky low-energy particle physics experiment. Pull quote: “If the deflections of the balance turn out differently than expected, it might mean several things. Such a result could open the door to entirely new physics if it showed that virtual particles don’t gravitate. But “a missing signal could also be because there is no Casimir effect in cuprates, or it is very weak,” says experimental physicist Markus Aspelmeyer of the University of Vienna. “Therefore, it is even more important to test separately from this experimentally.””

Massive "dead zone" to form in Gulf of Mexico, scientists warn. Newsbreak.com article. Pull quote: “"In a natural system, these nutrients aren't significant factors in algae growth because they are depleted in the soil by plants. However, with anthropogenically increased nitrogen and phosphorus input, algae growth is no longer limited," the college says. "Consequently, algal blooms develop, the food chain is altered, and dissolved oxygen in the area is depleted."”

What causes long COVID? Case builds for rogue antibodies. Nature.com article. Pull quote: “If the findings hold, clinicians might want to consider excluding individuals with long COVID from making blood donations, says Davide Robbiani, an immunologist at the Institute for Research in Biomedicine in Bellinzona, Switzerland.”

Review – Public ICS Disclosures – Week of 6-8-24 – Part 2

For Part 2 we have nine additional vendor disclosures from Schneider Electric (5), Siemens, VMware, Western Digital, and ZKTeco. We also have 28 vendor updates from HP (13), Schneider (2), and Siemens (13). In Part 3 we will look at researcher reports and exploits.

Advisories

Schneider Advisory #1 - Schneider published an advisory that describes a files or directories accessible to external parties vulnerability in their Modicon M340 and BMXNOE0100 and BMXNOE0110 products.

Schneider Advisory #2 - Schneider published an advisory that describes a use of broken or risky cryptographic algorithm vulnerability.

Schneider Advisory #3 - Schneider published an advisory that describes an exposure of resource to wrong sphere vulnerability in their EVlink Home Smart product.

Schneider Advisory #4 - Schneider published an advisory that describes a TOCTOU race condition in their SpaceLogic AS-P and AS-B products.

Schneider Advisory #5 - Schneider published an advisory that describes six vulnerabilities in their SAGE RTU products.

Siemens Advisory - Siemens published an advisory that describes an incorrect type conversion or cast vulnerability in their Tecnomatix Plant Simulation product.

VMware Advisory - VMware published an advisory that describes three vulnerabilities in their SD-WAN Edge and SD-WAN Orchestrator products.

Western Digital Advisory - Western Digital published an advisory that describes a cross-site scripting vulnerability in multiple Western Digital products.

ZKTeco Advisory - ZKTeco published an advisory that announced that they had a firmware update that “addresses minor vulnerabilities identified in certain models of our standalone terminals”.

Updates

HP Update #1 - HP published an update for their Aruba 9200 and 9000 Series Controllers advisory that was originally published on September 6^th, 2023.

HP Update #2 - HP published an update for their Aruba ClearPass Policy Manager advisory that was originally published on October 24^th, 2023.

HP Update #3 - HP published an update for their Aruba AirWave Management Platform advisory that was originally published on October 17^th, 2023 and most recently updated on October 23^rd, 2023.

HP Update #4 - HP published an update for their ArubaOS-Switch Switches advisory that was originally published on August 29^th, 2023.

HP Update #5 - HP published an update for their Aruba EdgeConnect SD-WAN Orchestrator advisory that was originally published on August 22^nd, 2023 and most recently updated on October 3^rd, 2023.

HP Update #6 - HP published an update for their Aruba Networking Virtual Intranet Access advisory that was originally published on August 15^th, 2023.

HP Update #7 - HP published an update for their Aruba CX Switches advisory that was originally published on August 1^st, 2023.

HP Update #8 - HP published an update for their Aruba Access Points advisory that was originally published on July 25^th, 2023.

HP Update #9 - HP published an update for their ArubaOS advisory that was originally published on July 11^th, 2023.

HP Update #10 - HP published an update for their Aruba EdgeConnect Enterprise advisory that was originally published on May 24^th, 2023.

HP Update #11 - HP published an update for their Aruba Access Points advisory that was originally published on May 9^th, 2023.

HP Update #12 - HP published an update for their Aruba Bypassing Wi-Fi Encryption advisory that was originally published on April 4^th, 2023, and most recently updated on April 6^th, 2023.

HP Update #13 - HP published an update for their ProLiant DL/DX/ML/SY/RL/XL/Edgeline Servers advisory that was originally published on April 2^nd, 2024 and most recently updated on June 3^rd, 2024.

Schneider Update #1 - Schneider published an update for their CODESYS Runtime advisory that was originally published on July 11^th, 2023, and most recently updated on April 9^th, 2024.

Schneider Update #2 - Schneider published an update for their Easy UPS advisory that was originally published on April 11^th, 2023, and most recently updated on June 13^th, 2023.

Siemens Update #1 - Siemens published an update for their SICAM Products advisory that was originally published on May 14^th, 2024.

Siemens Update #2 - Siemens published an update for their RUGGEDCOM APE1808 advisory that was originally published on March 12^th, 2024, and most recently updated on May 14^th, 2024.

Siemens Update #3 - Siemens published an update for their SIMATIC WinCC advisory that was originally published on February 13^th, 2024, and most recently updated on April 9^th, 2024.

Siemens Update #4 - Siemens published an update for their OPC UA Implementations advisory that was originally published on September 12^th, 2023, and most recently updated on May 14^th, 2024.

Siemens Update #5 - Siemens published an update for their Profinet Devices advisory that was originally published on July 13^th, 2021, and most recently updated on April 12^th, 2024.

Siemens Update #6 - Siemens published an update for their Webserver of Industrial Products advisory that was originally published on April 11^th, 2023, and most recently updated on May 9^th, 2023.

Siemens Update #7 - Siemens published an update for their n S7-1500 CPU Devices advisory that was originally published on January 10^th, 2023, and most recently updated on December 12^th, 2023.

Siemens Update #8 - Siemens published an update for their PROFINET Stack advisory that was originally published on April 12^th, 2022, and most recently updated on May 14^th, 2024.

Siemens Update #9 - Siemens published an update for their Parasolid and Teamcenter Visualization advisory that was originally published on August 8^th, 2023, and most recently updated on November 14^th, 2023.

Siemens Advisory # 10 - Siemens published an update for their GNU/Linux Subsystem advisory that was originally published on December 12^th, 2023, and most recently updated on May 14^th, 2024.

Siemens Advisory #11 - Siemens published an update for their SCALANCE XB-200 advisory that was originally published on March 12^th, 2024.

Siemens Advisory #12 - Siemens published an update for their SIMATIC RTLS advisory that was originally published on May 14^th, 2024.

Siemens Advisory #13 - Siemens published an update for their SICAM PAS/PQS advisory that was originally published on October 10^th, 2023.

 

For more information on these disclosures, including links to 3^rd party advisories and brief summaries of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-f31 - subscription required.

EPA Sends CWA PFAS Effluent Discharge NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking from the EPA on “Clean Water Act Effluent Limitations Guidelines and Standards for PFAS Manufacturers Under the Organic Chemicals, Plastics and Synthetic Fibers Point Source Category”. An advanced notice of proposed rulemaking (ANPRM) was published on March 17^th, 2021.

According to the abstract for the Fall 2023 Unified Agenda entry for this rulemaking:

“As announced in the Effluent Guidelines Program Plan 15 and as part of the EPA’s PFAS Strategic Roadmap: EPA’s Commitments to Action 2021-2024, EPA is revising the existing Organic Chemicals, Plastics, and Synthetic Fibers (OCPSF) Effluent Limitations Guidelines and Standards (ELGs) (40 CFR part 414) to address per- and polyfluoroalkyl substances (PFAS) discharges from facilities manufacturing PFAS.”

I will probably not cover this NPRM in any detail when it is published, but it will certainly be mentioned in the appropriate Short Takes post in this blog.

Chemical Incident Reporting – Week of 6-8-24

NOTE: See here for series background.

Ft Morgan, CO – 5-29-24

Local news reports: Here, here, and here.

Naturally occurring hydrogen sulfide release at sugar mill resulted in 1 dead and 4 hospitalized.

CSB reportable.

Mobile, AL – 6-1-24

Local news reports: Here and here.

Fire at pool supply company results in chlorine gas release. No injuries or damages reported.

Not CSB reportable.

New Bedford, MA – 6-9-24

Local news reports: Here, here, and here

Fire department responded to automated alarm for an anhydrous ammonia release at a seafood wholesaler. No injuries or damage were reported.

Not CSB reportable.

Waynesboro, PA – 6-11-24

Local news reports: Here, here, and here.

Explosion at manufacturing facility. Three employees were transported to hospitals. No damage reports. No information on the cause of the explosion.

Probable CSB reportable, at least one of the employees was transported to a burn hospital by air, so almost certainly admitted.

CRS Reports – Week of 6-8-24 – Reading Spending Bills

This week the Congressional Research Service published a report on “Understanding the Contents of an Appropriations Bill”. As we begin the appropriations process in earnest (in the House at least) this infographic provides a one-page introduction into what the formulistic contents of a spending bill mean. The CRS also provides a page that tracks the spending bill process for FY 2025.

Bills Introduced – 6-14-24

Yesterday, with just the House in session, there were 26 bills introduced. Three of those bills will receive additional coverage in this blog:

HR 8752 Department of Homeland Security Appropriations Act, 2025 Amodei, Mark E. [Rep.-R-NV-2] 

HR 8770 To establish a grant program carried out by the Department of Homeland Security to fund university-based cybersecurity clinics at junior or community colleges, historically Black colleges and universities (HBCUs), Hispanic-serving institutions (HSIs), and other minority-serving institutions, and for other purposes. Veasey, Marc A. [Rep.-D-TX-33] 

HR 8771 Making appropriations for the Department of State, foreign operations, and related programs for the fiscal year ending September 30, 2025, and for other purposes. Diaz-Balart, Mario [Rep.-R-FL-26]

There is one other bill that I would like to mention in passing:

HR 8758 To amend the Occupational Safety and Health Act of 1970 to expand coverage under such Act to public employees. Deluzio, Christopher R. [Rep.-D-PA-17] 

Currently the OSHA standards do not apply to State, local, tribal and territorial governmental entities. This is, in part, an unfunded mandate issue for these governments, but it is also a separation of powers issue. To be sure, most of these government entities take efforts to protect their employees from occupational hazards, they do not have OSHA hovering over their shoulder, keeping them in line. Okay, businesses do not have OSHA ‘hoovering over their shoulders’ either, there are not enough OSHA inspectors around to do that. But they do not have to worry about OSHA inspectors showing up after an accident or employee complaint.

This bill has no chance of being considered in the current congress, but it is nice to know that Deluzio and his staff care enough to go through the motions.

Review – Public ICS Disclosures – Week of 6-8-24 – Part 1

This week we have 28 vendor disclosures from ABB, Broadcom (2), FortiGuard (5), Hitachi Energy (6), Honeywell, HP (4), HPE (3), Palo Alto Networks (4), Phillips, and Phoenix Contact.

Advisories

ABB Advisory - The ABB security ‘Alerts and Notifications’ page lists an advisory (or maybe an update) for “ABB 800xA Base 6.0.x, 6.1.x CSLib communication DoS vulnerability”.

Broadcom Advisory #1 - Broadcom published an advisory that discusses seven vulnerabilities in their Brocade SANnav product.

Broadcom Advisory #2 - Broadcom published an advisory that that discusses seven vulnerabilities in their Brocade SANnav product.

FortiGuard Advisory #1 - FortiGuard published an advisory that describes a use of password hash with insufficient computational effort vulnerability in their FortiOS and FortiProxy products.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes a stack-based buffer overflow vulnerability in their FortiOS product.

FortiGuard Advisory #3 - FortiGuard published an advisory that describes a stack-based buffer overflow vulnerability in their FortiOS product.

FortiGuard Advisory #4 - FortiGuard published an advisory that describes a cross-site scripting vulnerability in their FortiOS and FortiProxy products.

FortiGuard Advisory #5 - FortiGuard published an advisory that describes a stack-based buffer overflow vulnerability in multiple FortiGuard product.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that describes an improper validation of certificate with host mismatch vulnerability in their UNEM/ECST product.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that describes an improper validation of certificate with host mismatch vulnerability in their FOXMANUN/FOXCST product.

Hitachi Energy Advisory #3 - Hitachi Energy published an advisory that describes a relative path traversal vulnerability in their XMC20 product.

Hitachi Energy Advisory #4 - Hitachi Energy published an advisory that describes a relative path traversal vulnerability in their FOX61x product.

Hitachi Energy Advisory #5 - Hitachi Energy published an advisory that describes eight vulnerabilities in their UNEM product.

Hitachi Energy Adviosry #6 - Hitachi Energy published an advisory that describes eight vulnerabilities in their FOXMAN-UN product.

Honeywell Advisory - Honeywell published an end-of-life notice for their “T” Series OmniSmart and Signo Readers.

HP Advisory #1 - HP published an advisory that describes two privilege escalation vulnerabilities in multiple HP products.

HP Advisory #2 - HP published an advisory that describes an information disclosure vulnerability in their Advance Mobile Application.

HP Advisory #3 - HP published an advisory that discusses two vulnerabilities in multiple HP products.

HP Advisory #4 - HP published an advisory that discusses an arbitrary code execution vulnerability in multiple HP products.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities (one with known exploit) in their Aruba Networking AirWave Management Platform.

HPE Advisory #2 - HPE published an advisory that discusses 25 vulnerabilities (17 with known exploits) in their Unified Topology Manager.

HPE Advisory #3 - HPE published an advisory that describes an arbitrary code execution vulnerability in their ProLiant Servers.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that describes an improper privilege management vulnerability in their Cortex XDR Agent.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that describes an insertion of sensitive information into a log file vulnerability in their GlobalProtect app.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory that describes an improper privilege management vulnerability in their Cortex XDR Agent.

Palo Alto Networks Advisory  #4 - Palo Alto Networks published an advisory that describes a cross-site scripting vulnerability in their Prisma Cloud Compute product.

Philips Advisory - Philips published an advisory that discusses the recent attacks on the Snowflake cloud platform.

Phoenix Contact Advisory - Phoenix Contact published an advisory that discusses an unbounded memory growth vulnerability in their FL MGUARD 1102/1105 products.

 

For more information on these disclosures, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-b93 - subscription required.

Short Takes – 6-14-24

NASA cancels spacewalk at ISS over 'spacesuit discomfort issue'. Phys.org article. Pull quote: “In announcing the spacewalk, NASA said two astronauts would remove some communications equipment from one of the ISS's laboratory modules with assistance from a robotic arm on the station. Dyson and Dominick were also going to swab surfaces on the ISS to "determine if microorganisms released through station vents can survive the external microgravity environment."”

F.A.A. Investigating How Counterfeit Titanium Got Into Boeing and Airbus Jets. NYTimes.com article (free). Pull quote: “So far, Spirit’s testing has confirmed that the titanium is the appropriate grade for airplane manufacturers. But the company has been unable to confirm that the titanium was treated through the approved airplane manufacturing process. The material passed some of the materials testing performed on it but failed others.”

n-Methylpyrrolidone (NMP); Regulation Under the Toxic Substances Control Act (TSCA). Federal Register EPA notice of proposed rulemaking. Summary: “To address the identified unreasonable risk, EPA is proposing to: prohibit the manufacture (including import), processing, and distribution in commerce and use of NMP in several occupational conditions of use; require worker protections through an NMP workplace chemical protection program (WCPP) or prescriptive controls (including concentration limits) for most of the occupational conditions of use; require concentration limits on a consumer product; regulate certain consumer products to prevent commercial use; and establish recordkeeping, labeling, and downstream notification requirements.” Comments due July 15^th, 2024.

Long COVID finally gets a universal definition. ScienceNews.org article. Pull quote: “Over time, Oller says, the definition may be refined to include subtypes of long COVID, much the way cancer is an overarching definition of runaway cell growth but is divided by where the cancer occurs and the mutations that cause it. But for now, she says, starting out broad will allow people whose symptoms don’t “fit into a nice little package” to have their condition recognized and acknowledged.” NAS article.

House Passes HR 8070 – FY 2025 NDAA

This morning, the House concluded their consideration of HR 8070, the FY 2025 National Defense Authorization Act, passing two more groups of en block amendments and passing three other stand-alone amendments. Then the House passed the bill with a near party line (6 Democrats voting aye, and 3 Republicans voting nay) vote of 217 to 199 with 15 members not voting.

The voice votes on en bloc #4 (9:31 am EDT) and #5 (9:45 am EDT) approved a total of 115 amendments. Between all five en bloc amendments the 14 (4 cybersecurity, 5 space, 3 vehicle technology and 2 UAS) amendments that I briefly discussed on Wednesday were adopted by the House.

The bill now heads to the Senate for further consideration. The Senate Armed Forces Committee was working on their version of an NDAA bill this week. Once that language and report are passed, the Senate will (sooner or later) take up HR 8070 with the first amendment to be considered will be a substitute language amendment with language from the Senate version of the bill. When that most likely more moderate authorization bill is passed in the Senate it will be sent back to the House for consideration of the revised language. The House leadership would then be forced to consider whether they were willing to use Democratic votes to pass the Senate version or insist on a conference committee to resolve the differences between the two versions. The 14 amendments discussed above could all end up in a conference bill.

The conference version of the bill would still likely require opposition votes to pass, but that would be after the November election and that would be less of a problem for Speaker Johnson. Unless, of course, if Trump is elected President and the Republican gain control of the Senate and retain control of the House. Then all bets are off.

Transportation Chemical Incidents – Week of 5-11-24

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 522 (449 highway, 56 air, 7 rail, water 1)

• Serious incidents – 5 (5 Bulk release, 1 evacuation, 1 injury, 0 death,1 major artery closed, 0 fire/explosion).

• Largest container involved – 30,290-gal DOT 117R100W railcar {Hydrocarbons, Liquid, N.O.S.} Vapor leak from PRV seal at railcar repair facility. (Note: The data base listed a 221,700-lbs hopper car of ammonium nitrate, but that is ‘smaller’ that a 30,290-gal liquid railcar).

• Largest amount spilled – 2,600-gal DOT 412 trailer (Hydrochloric Acid) Bleeder valve on product transfer line left open during unloading operations.

NOTE: Links above are to the Form 5800.1 for the described incidents.

Most Interesting Chemical: Amyl Acetates (also known as banana oil) – Any one or more of six isomers. Flammable liquid with varying flash points depending on the isomer (lowest 69°F). Water miscible, but floats on water, so water may spread fire. Not toxic but noxious at relatively low vapor concentrations.

Bills Introduced – 6-13-24

Yesterday, with both the House and Senate in Washington, there were 62 bills introduced. Two of those bills will receive additional attention in this blog:

HR 8741 To establish the Office of Information and Communications Technology and Services within the Bureau of Industry and Security of the Department of Commerce, and for other purposes. Slotkin, Elissa [Rep.-D-MI-7]

HR 8742 To establish the Office of Information and Communications Technology and Services within the Bureau of Industry and Security of the Department of Commerce, and for other purposes. Slotkin, Elissa [Rep.-D-MI-7]

It will be interesting to see if these are actually duplicate bills that were submitted by accident or if there are differences between them.

OMB Reinstates CSB Incident Reporting ICR - 6-13-24

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had reinstated the Chemical Safety Board’s information collection request (ICR) for the CSB’s Accidental Release Reporting. An earlier reinstatement notice had reinstated the collection at the earlier burden estimate levels. Yesterday’s action changed the approved ICR to the new levels requested by CSB.

Burden Estimate	Previous	New
Responses	201	100
Burden (hrs)	50	25
Cost	$1850	$925

CSB reported in their Supporting Document provided to OIRA that the change in the burden estimate was due to a review of recent historical records, not an actual prediction of a decrease in number of reportable incidents.

The current ICR approval will remain in force through June 30^th, 2027.

Short Takes – 6-13-24

Blue Origin joins SpaceX and ULA on Pentagon list for $5.6B in launch contracts. GeekWire.com article. Pull quote: “The amounts going to each of the three launch providers in the Phase 3 Lane 1 program will be determined by the task orders that go out for specific launches over the next five years. In a news release, the U.S. Space Force’s Space Systems Command said it was releasing requests for proposals relating to two task orders so far — one that would cover seven launches for the Space Development Agency, and another for the National Reconnaissance Office.”

This Strange Fungal Condition Makes You Drunk without Drinking. ScientificAmerican.com article.  Pull quote: “The currently understood mechanism for how this happens involves a number of factors that may contribute to an increased likelihood of the syndrome developing. These include having taken frequent or prolonged courses of antibiotics; having diabetes, inflammatory bowel disease or liver disease; and having a possible genetic predisposition through mutations that affect specific enzymes that help to metabolize and eliminate alcohol. “These factors need to collide together to create the perfect storm,” Zewude says.”

Massive potential lithium source found in Pennsylvania. CEN.ACS.org article. Pull quote: “Wells in northeastern Pennsylvania have a median lithium concentration of 205 mg/L, while those in the southwest had a median of 127 mg/L. Lithium today is extracted from brines containing 200 mg/L, but higher concentrations of over 500 mg/L improve the economics for traditional evaporation-based techniques.” 

House Considers HR 8070 – FY 2025 NDAA – 6-13-24

Today, the House continued consideration of HR 8070, the FY 2025 National Defense Authorization Act. Debate on amendments ended today at 3:36 pm EDT with amendment #55. Debate will resume tomorrow.

Earlier in the debate (3:41 pm EDT), the House considered en bloc amendments #2 and #3 which included 123 less-controversial amendments between #4 and #234. The House approved the en bloc amendments by a voice votes. They included two more of the fourteen amendments I discussed Wednesday morning:

124. Green (TN): Mandates that the Department of Defense produce a report to Congress on the feasibility of furnishing the national guard of every state a cyber unit to ensure the state has the ability to quickly respond to cyber attacks. (10 minutes), and

141. Himes (CT), Crawford (AR), Bergman (MI): Expresses the sense of Congress the importance of comprehensive cislunar Space Domain Awareness capabilities and the need to ensure the safety of flight of civil and commercial missions in cislunar space. Directs the Chief of Space Operations to deliver a report on three things: requirements for cislunar, the department’s plan for researching and developing technologies for cislunar, and how the department coordinates with the Cislunar Technology Strategy Interagency Working Group regarding the progress made on the objectives laid out in the November 2022 National Cislunar Science and Technology Strategy. (10 minutes).

Review – 19 Advisories and 2 Updated Published – 6-13-21

Today, CISA’s NCCIC-ICS published nineteen control systems security advisories for products from Motorola Solutions, Rockwell Automation (3), Fuji Electric, Siemens (13). They updated two advisories for products from Mitsubishi Electric.

Siemens published one additional advisory and 13 updates that have not been addressed by CISA. I will cover them this weekend.

Advisories

Motorola Advisory - This advisory describes seven vulnerabilities in the Motorola Solutions Vigilant License Plate Readers.

Rockwell Advisory #1 - This advisory describes an improper authentication vulnerability in the Rockwell FactoryTalk View SE software.

Rockwell Advisory #2 - This advisory describes an incorrect permissions assignment for critical resource vulnerability in the Rockwell FactoryTalk View SE software.

Rockwell Advisory #3 - This advisory describes an improper authentication vulnerability in the Rockwell FactoryTalk View SE software.

Fuji Advisory - This advisory describes two vulnerabilities in the Fuji Tellus Lite V-Simulator.

SINEC Advisory - This advisory discusses eight vulnerabilities in the Siemens SINEC Traffic Analyzer.

SCALANCE Advisory #1 - This advisory describes seven vulnerabilities in the Siemens SCALANCE W700 802.11 AX family of devices.

SCALANCE Advisory #2 - This advisory discusses eight vulnerabilities in the Siemens SCALANCE XM-400/XR-500 products.

SIMATIC Advisory #1 - This advisory discusses 23 vulnerabilities (three with known exploits) in the Siemens SIMATIC and SIPLUS products.

SIMATIC Advisory #2 - This advisory describes a use of insufficiently random values vulnerability in the Siemens SIMATIC S7-200 SMART devices.

SICAM Advisory - This advisory describes an improper NULL termination vulnerability in the Siemens ICAM AK3, SICAM BC, and SICAM TM products.

Teamcenter Advisory - This advisory describes three vulnerabilities in the Siemens Teamcenter Visualization and JT2Go products.

PowerSys Advisory - This advisory describes an improper authentication vulnerability in the Siemens PowerSys product.

TIM Advisory - This advisory discusses 32 vulnerabilities (five with known exploits) in the Siemens SIPLUS TIM 1531 IRC.

SITOP Advisory - This advisory discusses three out-of-bounds write vulnerabilities in the Siemens SITOP UPS1600 uninterruptible power supplies.

ST7 Advisory - This advisory discusses 37 vulnerabilities (4 with known exploits, 2 in CISA’s KEV catalog) in the Siemens ST7 ScadaConnect products.

TIA Advisory - This advisory describes a creation of a temporary file in directory with insecure permissions vulnerability in the Siemens TIA Administrator.

Mendix Advisory - This advisory describes an improper privilege management vulnerability in the Siemens Mendix Applications.

Updates

Mitsubishi Update #1 - This update provides additional information on the Multiple Products advisory that was originally published on October 5^th, 2020 and most recently updated on June 28^th, 2023.

Mitsubishi Update #2 - This update provides additional information on the MELSEC-Q/L Series advisory that was originally published on March 14^th, 2024 and most recently updated on May 16^th, 2024.

 

For more information on these advisories, including links to 3^rd party vendors and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/19-advisories-and-2-updated-published - subscription required.