Review – 6 Advisories and 4 Updates Published – 2-5-26

Today CISA’s NCCIC-ICS published six control system security advisories for products from Hitachi Energy (2), Ilevia, 06 Automation, Mitsubishi, and TP-Link. They also updated advisories for products from KiloView, Multiple India-based Vendors, Hitachi Energy, and Mitsubishi.

Advisories

Hitachi Energy Advisory #1 - This advisory discusses the BlastRadius.Fail vulnerability in their FOX61x product.

NOTE: I briefly discussed the vulnerability on January 31^st, 2026.

Hitachi Energy Advisory #2 - This advisory discusses the BlastRadius.Fail vulnerability in their FOX61x product.

Ilevia Advisory - This advisory describes nine vulnerabilities (each with publicly available exploits) in the Ilevia EVE X1 Server.

06 Automation Advisory - This advisory describes an out-of-bounds write vulnerability in their Open62541 OPC UA stack.

Mitsubishi Advisory - This advisory describes an improper validation of specified quantity in input vulnerability in the MELSEC iQ-R Series products.

TP-Link Advisory - This advisory describes an improper authentication vulnerability in the TP-Link VIGI Series IP Cameras.

Updates

KiloView Update - This update provides additional information on the Encoder Series advisory that was originally published on January 29^th, 2025.

NOTE: The original advisory was a “has not responded to requests to work with CISA” advisory.

India Based Update - This update provides additional information on the CCTV Cameras advisory that was originally published on December 9^th, 2025.

NOTE: The original advisory was a “has not responded to requests to work with CISA” advisory.

Hitachi Energy Update - This update provides additional information on the Relion 670/650 advisory that was originally published on July 3^rd, 2025, and most recently updated on January 22^nd, 2026 (CISA advisory dates, not the Hitachi Energy dates listed in the ‘Revision History’).

NOTE: I briefly reported the updated information on February 1^st, 2026.

Mitsubishi Update - This update provides additional information on the MELSOFT Update Manager advisory that was originally published on July 3^rd, 2025, and most recently updated on January 20^th, 2026.

NOTE: CVE-2025-0411, listed as a third-party vulnerability in this advisory, was listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog today (listed on “February 6^th, 2026”?).

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-4-updates-published - subscription required.

Review – 3 Advisories and 3 Updates Published – 1-29-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from Rockwell Automation (2) and KiloView. They also updated advisories for products from Mitsubishi Electric (2) and BrightSign.

Advisories

Rockwell Advisory #1 - This advisory describes a missing release of memory after effective lifetime vulnerability in the Rockwell ControlLogix Redundancy Enhanced Module.

NOTE: I briefly discussed this vulnerability on January 25^th, 2026.

Rockwell Advisory #2 - This advisory describes nine uncontrolled resource consumption vulnerabilities in the Rockell ArmorStart LT.

NOTE: I briefly discussed this vulnerability on January 25^th, 2026.

KiloView Advisory - This advisory describes a missing authentication for critical function vulnerability in the KiloView Encoder series products.

Updates

Mitsubishi Update #1 - This update provides additional information on the CNC Series advisory that was originally published on July 24^th, 2025, and most recently updated on December 2^nd, 2025.

Mitsubishi Update #2 - This update provides additional information on the Iconics Digital Solutions advisory that as originally published on May 20^th, 2025, and most recently updated on January 8^th, 2026.

I briefly discussed the added information (Mitsubishi Update #1 note) on January 8^th, 2025.

BrightSign Update - This update provides additional information on the Players advisory that as originally published on May 6^th, 2026.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-3-updates-published-469 - subscription required.