Review – 6 Advisories Published – 10-6-26

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Hitachi Energy (4), Savannah, and Johnson Controls. 

NOTE: There has been a minor change in the format of the ‘Vulnerabilities’ section of the CISA advisories; more information is available by default on each CVE. 

Advisories  

Hitachi Energy Advisory #1 - This advisory describes six vulnerabilities in the Hitachi Energy RTU500. The vulnerabilities were reported to CISA by Dragos. 

Hitachi Energy Advisory #2 - This advisory discusses two vulnerabilities in the Hitachi Energy REB500. These are third-party vulnerabilities. 

Hitachi Energy Advisory #3 - This advisory discusses an improper input validation vulnerability in the Hitachi Energy SOI. This is a third-party (Apache) vulnerability that is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. 

Hitachi Energy Advisory #4 - This advisory describes two vulnerabilities in the Hitachi Energy Asset Suite. The vulnerabilities were reported to CISA by EDF. 

Savannah Advisory - This advisory describes a classic buffer overflow vulnerability in the Savannah lwIP SMTP client. The vulnerability was reported by Xchg Labs 

Johnson Control Advisory - This advisory describes two vulnerabilities in the Johnson Controls EasyIO FG. The vulnerabilities were reported by Gabriele Gardois, Zachary Bushell and Lorenzo De Carli of the University of Calgary. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-published-10-6-26 - subscription required. 

Review – 6 Advisories and 1 Update Published – 10-1-26

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Meari, Johnson Controls (2), ABB, Monta, and Armatura. They also updated an advisory for products from CISA. 

Advisories  

Meari Advisory - This advisory describes two vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The vulnerabilities were reported to CISA by Gabriel Adams. CISA notes that: “Meari did not respond to CISA's coordination attempts.” 

Johnson Controls Advisory #1 - This advisory describes a cleartext transmission of sensitive information vulnerability in the Johnson Controls EasyIO Neo Series EC and CW Controllers. The vulnerability was reported by Gabriele Gardois. 

Johnson Controls Advisory #2 - This advisory describes an exposure of sensitive information to an unauthorized actor vulnerability in the Johnson Controls EasyIO Neo Series EC and CW Controllers. The vulnerability was reported by Gabriele Gardois. 

ABB Advisory - This advisory describes two vulnerabilities in the ABB Protection and Control IED Manager PCM600. The vulnerabilities were reported by Abhinav Agarwal.  

Monta Advisory - This advisory describes four vulnerabilities in the Monta monta.app EV charging application. The vulnerabilities were reported to CISA by an anonymous researcher. 

Armatura Advisory - This advisory describes five vulnerabilities in the Armatura LLC Armatura One web-based security platform. The vulnerabilities were reported to CISA by Andrew Capobianco of RewCon.co. One of the vulnerabilities is included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog. 

Updates  

CISA Update  

This update provides additional information on the Malcolm advisory that was originally published on September 11th, 2026. The new information includes adding self-reference to Web version. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-1-update-published-fd7 - subscription required. 

1 Advisory Published – 8-20-26

Today, CISA’s NCCIC-ICS published one control system security advisory for products from Johnson Controls. 

Advisories  

Johnson Controls Advisory - This advisory describes a cleartext storage of sensitive information in memory vulnerability in the Johnson Controls Simplex Incident Manager fire alarm management system. 

15 Advisories Published – 8-13-26

Today, CISA’s NCCIC-ICS published 14 control systems security advisories for products from Johnson Controls (2), Siemens (8), ANDRITZ, Hitachi Energy, Haiwell, and AVEVA. They also published a medical device security advisory for products from Flow Neuroscience. 

Advisories  

Johnson Control Advisory #1 - This advisory describes a cross-site scripting vulnerability in the Johnson Controls Metasys UI. 

Johnson Control Advisory #2 - This advisory describes two vulnerabilities in the Johnson Controls Airwall product. 

Siemens Advisory #1 - This advisory describes two vulnerabilities in the Siemens LOGO! Soft Comfort product. The vulnerability was reported to Siemens by Jeroen Slobbe. 

Siemens Advisory #2 - This advisory describes 7 vulnerabilities in the Siemens Solid Edge products. The vulnerabilities were reported to Siemens by Yutao Wang from YunShangHuaAn and Yu Zhou from Southeast University. 

Siemens Advisory #3 - This advisory describes two vulnerabilities in the Siemens Simcenter Femap product. The vulnerabilities were reported to Siemens by Michael Heinzl. 

Siemens Advisory #4 - This advisory describes an out-of-bounds read vulnerability in the Siemens Parasolid product. The vulnerability was reported to Siemens by Michael Heinzl. 

Siemens Advisory #5 - This advisory discusses an OS command injection vulnerability in the  Siemens Siveillance Video products. This is a third-party (Milestone) vulnerability. 

Siemens Advisory #6 - This advisory describes an improper check for unusual or exceptional conditions vulnerability in the Siemens Desigo DXR and PXC Controllers. The vulnerability was reported to Siemens by Thomas EBI from Sauter.  

Siemens Advisory #7 - This advisory describes two vulnerabilities in the Siemens License Server. The vulnerabilities were reported to Siemens by Intel PSIRT. 

Siemens Advisory #8 - This advisory discusses two vulnerabilities in the Siemens RUGGEDCOM APE1808 products. These are third-party (FortiGuard) vulnerabilities. 

ANDRITZ Advisory - This advisory describes four vulnerabilities in the ANDRITZ HIPASE-250 and 250 SCALA products. The vulnerabilities were reported to CISA by Duc Anh Nguyen and Ta Duc Thien of NTCS OT Penetration Testing Team. 

Hitachi Energy Advisory - This advisory discusses the Dirty Frag vulnerabilities in the Hitachi Energy APM Edge Product. 

Haiwell Advisory - This advisory describes an OS command injection vulnerability in the Haiwell Haiwell IoT Cloud HMI Gateway. The vulnerability was reported to CISA by Fiqram Akmal. 

AVEVA Advisory - This advisory describes a deserialization of untrusted data vulnerability in the AVEVA Enterprise SCADA.  

Flow Advisory - This advisory describes a use of hard-coded credentials vulnerability in the Flow Neuroscience FL-100 neuromodulation device. The vulnerability was reported to CISA by A.C. Buglione.