Review – 9 Advisories and 2 Updates Published – 5-28-26

Yesterday, CISA’s NCCIC-ICS published eight control system security advisories for products from XCharge, Schneider Electric, KMW, CP Plus, ABB (2), Jinan USR IOT Technology, and MacGregor. There is a medical device security advisory for products from Fourth Frontier. Finally, there are also updates for products from ABB and Mitsubishi. 

Advisories  

XCharge Advisory - This advisory describes three vulnerabilities (one with publicly available exploit) in the XCharge C6 vehicle charger. 

Schneider Advisory - This advisory describes a cleartext storage of sensitive information vulnerability in the Schneider EcoStruxure Machine Expert HVAC. 

NOTE: I briefly discussed this vulnerability on May 16th, 2026. 

KMW Advisory - This advisory describes an unverified password change vulnerability in the KMW CCTV Security Cameras. 

CP Advisory - This advisory describes a cross-site scripting vulnerability in the CP Plus 8 Ch. Network Video Recorder. 

ABB Advisory #1 - This advisory describes an active debug code vulnerability in the ABB Busch-Welcome 2 Wire Door Opener Actuator.  

NOTE: I briefly discussed the vulnerability on July 26th, 2025. 

ABB Advisory #2 - This advisory describes a cross-site scripting vulnerability in the ABB EIBPORT product.  

NOTE: I briefly discussed this vulnerability on October 11th, 2025. 

Jinan Advisory - This advisory describes a use of hard-coded credentials vulnerability in the Jinan USR-W610 RS232/485 to Wi-Fi/Ethernet Converter. 

MacGregor Advisory - This advisory describes five vulnerabilities in the MacGregor Voyage Data Recorder (VDR) G4e. 

Fourth Frontier Advisory - This advisory describes a missing authentication for critical function vulnerability in the Fourth Frontier X Android application. 

Updates  

ABB Update - This update provides additional information on the ABB Ability Zenon Remote Transport advisory that was originally published on May 26th, 2026. 

Mitsubishi Update - This update provides additional information on the Factory Automation Engineering Products advisory that was originally published on July 30th, 2026, and most recently updated on April 11th, 2023. 

For more information on these advisories, including a down-the-rabbit-hole look at 3rd party vulnerabilities in the XCharge C6 vehicle charger, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/9-advisories-and-2-updates-published - subscription required. 

FRA Publishes CP Safety Plan Notice

The DOT’s Federal Railroad Administration (FRA) published a notice in today’s Federal Register (79 FR 54343) that it had received a petition from the Canadian Pacific  Railroad Company for the approval of their Railroad Safety Program Plan (RSPP) as required by 49 CFR 236.905. The actual copy of the RSPP is available on the Federal eRulemaking Portal (www.Regulations.gov; Docket # FRA-2014-0078).

The FRA is apparently not sure if it wants public comments on the RSPP or not. The notice initially states that: “FRA is not accepting comments on this RSPP.” But later in the notice it states that: “Interested parties are invited to participate in these proceedings by submitting written views, data, or comments.” The docket is certainly open for comments though, so feel free to add your two cents worth.

NOTE: The RSPP is the implementation plan for the railroad’s positive train control (PTC) system.