Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from NASA on “Procedures for Implementing the Freedom of Information Act (FOIA)”. There is no record of a notice of proposed rulemaking, so this must be a direct final rule.
There is no entry in the 2026 Unified Agenda for this rulemaking.
Today CISA’s NCCIC-ICS published 11 control system security advisories for products from MZ Automation (2), Watchfire, 06 Automation, Mitsubishi Electric, NASA, Rockwell Automation, Schneider Electric, Toptech, Johnson Controls, and MikroTik. They also updated an advisory for products from Hardy Barth.
Advisories
MZ Automation Advisory #1 - This advisory describes two vulnerabilities in the MZ Automation lib60870.
MZ Automation Advisory #2 - This advisory describes eight vulnerabilities in the MZ Automation GmbH libiec61850.
Watchfire Advisory - This advisory describes a hard-coded cryptographic key vulnerability in the Watchfire Controller Software.
06 Automation Advisory - This advisory describes four vulnerabilities in the o6 Automation open62541 OPC UA stack.
Mitsubishi Advisory - This advisory describes an improper enforcement of message integrity during transmission in a communication channel vulnerability in the Mitsubishi CC-Link IE TSN Communication Protocol.
NASA Advisory - This advisory describes a NULL pointer dereference vulnerability in the NASA Core Flight System (cFS) Health & Safety (HS) Application.
NOTE: This vulnerability is related to an incomplete fix for CVE 2026-15352.
Rockwell Advisory - This advisory describes an improper check for certificate revocation vulnerability in the Rockwell CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module.
Schneider Advisory - This advisory describes an out-of-bounds write vulnerability in the Schneider IGSS.
Toptech Advisory - This advisory describes a missing authentication for critical function vulnerability in the Toptech Systems RCU II+ and Multiload II+.
Johnson Controls Advisory - This advisory describes three vulnerabilities in the Johnson Controls OpenBlue Employee smart building ecosystem.
MikroTik Advisory - This advisory describes an insufficient session expiration vulnerability in the MikroTik RouterOS.
Updates
Hardy Barth Update - This update provides additional information on the Salia EV Charge Controller advisory that was originally published on April 21st, 2026.
For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published-68f - subscription required.
Today CISA’s NCCIC-ICS published nine control system security advisories for products from Rockwell Automation (5), SALTO, Siemens, AutomationDirect, and NASA. I also look at eight other new advisories published by Siemens this week.
Advisories
Rockwell Advisory #1 - This advisory describes a cross-site scripting vulnerability in the Rockwell FactoryTalk DataMosaix.
Rockwell Advisory #2 - This advisory describes a double free vulnerability in the Rockwell Flex 5000 Adapter.
Rockwell Advisory #3 - This advisory describes three vulnerabilities in multiple Rockwell product lines.
Rockwell Advisory #4 - This advisory describes an improper validation of integrity check value vulnerability in the Rockwell 1756-EN2, 1756-EN3, and 1756-ENBT products.
Rockwell Advisory #5 - This advisory describes four vulnerabilities in the Rockwell Arena product.
SALTO Advisory - This advisory describes an authorization bypass through user-controlled key vulnerability in the SALTO ProAccess Space product.
Siemens Advisory - This advisory describes four vulnerabilities in the Siemens SICAM 8 product line.
AutomationDirect Advisory - This advisory describes six vulnerabilities in the AutomationDirect Productivity Suite.
NASA Advisory This advisory describes a NULL pointer dereference vulnerability in the NASA Core Flight System (cFS) Health & Safety (HS) Application.
For more information on these advisories, as well as a listing of eight other Siemens advisories published this week, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/9-advisories-published-7-16-23 - subscription required.
Yesterday, the House Science, Space, and Technology Committee added a hearing to be held today on “A Review of the President’s Budget Request for the National Aeronautics and Space Administration for Fiscal Year 2027”. The sole witness was NASA Administrator Isaacman (statement here).
It is interesting to note that the opening statements from both Chair Babin and Ranking Member Lofgren expressed concerns about cuts proposed in the President’s FY 2027 budget request. A video of the hearing is available here.
Posts
All Comments
