Review – 8 Advisories Published – 6-30-26

Today CISA’s NCCIC-ICS published 7 control system security advisories for products from Delta Electronics, Stonefly, B&R Automation, Schneider (2) Frangoteam, and Mitsubishi. They also published a medical device security advisory for products from OFFIS. 

Advisories  

Delta Advisory - This advisory describes two vulnerabilities in the Delta Electronics DVP12SE PLC. 

StoneFly Advisory - This advisory This advisory describes five vulnerabilities in the StoneFly Storage Concentrator. 

B&R Advisory - This advisory discusses a race condition within a thread vulnerability in multiple B&R products.  

Schneider Advisory #1 - This advisory describes two vulnerabilities in the Schneider Electric EasyLogic T150 and Saitel DP RTU. 

Schneider Advisory #2 - This advisory describes an improper restriction of XML external entity reference vulnerability in the Schneider Electric EcoStruxure IT Data Center Expert. 

Frangoteam Advisory - This advisory describes an authentication bypass by spoofing vulnerability in the Frangoteam FUXA SCADA/HMI. 

Mitsubishi Advisory - This advisory discusses four vulnerabilities in the Mitsubishi MELSOFT Update Manager SW1DND-UDM-M.  

OFFIS Advisory - This advisory describes five vulnerabilities in the OFFIS DCMTK Toolkit. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/8-advisories-published-6-30-26 - subscription required. 

Review – 9 Advisories and 1 Update Published – 6-25-26

Today CISA’s NCCIC-ICS published 7 control system security advisories for products from Schneider Electric, Delta Electronics, H.View, Daktronics, Horner Automation, EVoke Systems, and Yokogawa. They also published two medical device security advisories for products from OHIF and pydicom. They also updated an advisory for AzeoTech. 

Advisories  

Schneider Advisory - This advisory describes three vulnerabilities in the Schneider PowerLogic P7. 

Delta Advisory - This advisory describes a deserialization of untrusted data vulnerability in the Delta DTM Soft product. 

H.VIEW Advisory - This advisory describes two vulnerabilities in the H. VIEW HV-500S6 IP Camera. 

Daktronics Advisory - This advisory describes three vulnerabilities in the Daktronics Controller firmware. 

Horner Advisory - This advisory describes an out-of-bounds read vulnerability in the Horner Cscape product. 

EVoke Advisory - This advisory describes four vulnerabilities in the EVoke Charging Station Management System. 

Yokogawa Advisory - This advisory describes a cleartext transmission of sensitive information vulnerability in the Yokogawa FAST/TOOLS and CI Server. 

OHIF Advisory - This advisory describes a server-side request forgery vulnerability in the Open Health Imaging Foundation (OHIF) Viewers DICOM. 

Pydicom Advisory - This advisory describes a path traversal vulnerability in the pydicom pynetdicom Library. 

Updates  

AzeoTech Advisory - This update provides additional information on the DAQFactory advisory that was originally published on June 18th, 2026. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/9-advisories-and-1-update-published - subscription required. 

Review – 4 Advisories Published – 4-16-26

 Today CISA’s NCCIC-ICS published four control systems security advisories for products from AVEVA, Anviz, Horner Automation, and Delta Electronics. 

Advisories  

AVEVA Advisory - This advisory describes a missing authorization vulnerability in the AVEVA Pipeline Simulation product. 

Anviz Advisory - This advisory describes 12 vulnerabilities in multiple Anviz time clock products. 

Horner Advisory - This advisory describes a weak password requirements vulnerability in the Horner Cscape, XL4, and XL7 PLCs. 

Delta Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Delta ASDA-Soft configuration software. 

For more information on these advisories, including a brief discussion about the missing Siemens advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-4-16-23 - subscription required.