Review - Public ICS Disclosures – Week of 5-16-26 – Part 2

 For Part 2 this week we have nine additional vendor disclosures from Dell, HPE (4), Philips, TP-Link (2), and Wireshark. Finally, there are six vendor updates from Broadcom, ELECOM, HP, HPE, and Palo Alto Networks (2). 

Advisories  

Dell Advisory - Dell published an advisory that discusses 29 vulnerabilities in their ThinOS product. All but two of the vulnerabilities are third-party vulnerabilities. 

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities in their Telco Universal SLA Management product. 

HPE Advisory #2 - HPE published an advisory that discusses the CopyFail vulnerability. 

HPE Advisory #3 - HPE published an advisory that discusses eight vulnerabilities (seven have publicly available exploits) in their Unified OSS Console Assurance Monitoring product. 

HPE Advisory #4 - HPE published an advisory that describes a privilege escalation vulnerability in their Cray Programming Environment. 

Philips Advisory - Philips published an advisory that discusses an F5 Networks heap-based buffer overflow vulnerability. 

TP-Link Advisory #1 - TP-Link published an advisory that describes an improper input validation vulnerability in multiple TP-Link Range Extenders products. 

TP-Link Advisory #2 - TP-Link published an advisory that describes a generation of error message that contains sensitive information vulnerability in their web management interface of Archer AX72. 

Wireshark Advisory - Wireshark published an advisory that describes a dissector crash vulnerability in their ROHC protocol. 

Updates  

Broadcom Update - Broadcom published an update for their Brocade ASCG advisory that was originally published on January 7th, 2025, and most recently updated on March 3, 2026. 

ELECOM Update - JP-CERT published an update for their LAN routers advisory that was originally published on May 12th, 2026. 

HP Update - HP published an update for their Intel PROSet/Wireless WiFi Software advisory that was originally published on November 11th, 2025, and most recently updated on April 1st, 2026. 

HPE Update - HPE published an update for their Aruba Networking Virtual Intranet Access advisory that was originally published on January 13th, 2026. 

PAN Update #1 - PAN published an update for their Cloud Authentication Service advisory that was originally published on May 13th, 2026, and most recently updated on May15th, 2026. 

PAN Update #2 - PAN published an update for their DNS Proxy Server advisory that was originally published on May 13th, 2026, and most recently updated on May15th, 2026. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-37e - subscription required. 

Review – Public ICS Disclosures – Week of 5-16-26 – Part 1

This was a moderately busy disclosure week. We have bulk vendor disclosures from Splunk (15). There are 11 additional vendor disclosures from Arista, Broadcom (4), CODESYS, Hitachi, and HP (4). 

Advisories  

Bulk Vendor Disclosures – Splunk (15). 

Arista Advisory - Arista published an advisory that discusses a use after free vulnerability in multiple Arista products. 

Broadcom Advisory #1 - Broadcom published an advisory that discusses three vulnerabilities (one with publicly available exploits) in their ASCG 3.4.0b for container-tools. 

Broadcom Advisory #2 - Broadcom published an advisory that discusses a path traversal vulnerability (with publicly available exploit) in their Brocade ASCG product. 

Broadcom Advisory #3 - Broadcom published an advisory that discusses eleven vulnerabilities (four with publicly available exploits) in their Brocade ASCG3.4.0b Base OS. 

Broadcom Advisory #4 - Broadcom published an advisory that discusses 33 vulnerabilities in their Brocade ASCG3.4.0b Base OS. 

CODESYS Advisory - CODESYS published an advisory that describes an insufficiently protected credentials vulnerability in their CODESYS Visualization product. 

Hitachi Advisory - Hitachi published an advisory that discusses 41 vulnerabilities in their Disk Array Systems. 

HP Advisory #1 - HP published an advisory that describes two vulnerabilities in their Linux Imaging and Printing software. 

HP Advisory #2 - HP published an advisory that discusses a use of hard-coded cryptographic key vulnerability in their ZGX Nano G1n AI Station. 

HP Advisory #3 - HP published an advisory that describes an information disclosure vulnerability in their ScanJet Pro and ScanJet Enterprise printers. 

HP Advisory #4 - HP published an advisory that discusses eleven vulnerabilities in multiple HP product lines. 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-adf - subscription required.