Review – 3 Advisories and 1 Update Published – 3-26-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from PTC, OpenCode Systems, and WAGO. They also updated an advisory for products from Honeywell.

Advisories

PTC Advisory - This advisory describes a code injection vulnerability (with available indicators of compromise) in the PTC Windchill and FlexPLM product lifecycle management products.

OpenCode Advisory - This advisory describes an improper access control vulnerability in the OpenCode Systems OC Messaging and USSD Gateway.

WAGO Advisory - This advisory describes the a hidden functionality vulnerability in the WAGO Industrial Managed Switches.

Updates

Honeywell Update - This update provides additional information on the IQ4x BMS Controller advisory that was originally published on March 10^th, 2026.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-4be - subscription required.

Review – 11 Advisories Published – 8-15-24

Today, CISA’s NCCIC-ICS published eleven control system security advisories for products from Siemens (9), PTC Kepware, and AVEVA.

Advisories

NX Advisory - This advisory describes an out-of-bounds read vulnerability in the Siemens NX integrated toolset.

COMOS Advisory - This advisory discusses two vulnerabilities in the COMOS unified data platform.

Location Intelligence Advisory - This advisory describes three vulnerabilities in the Siemens Location Intelligence web-based application software.

SINEC Advisory #1 - This advisory discusses 29 vulnerabilities (five with publicly available exploits) in the Siemens SINEC network management systems (NMS).

SINEC Advisory #2 - This advisory describes five vulnerabilities in the Siemens SINEC Traffic Analyzer.

LOGO! Advisory - This advisory describes a cleartext storage of a password vulnerability in the Siemens LOGO! Products.

TEAMCENTER Visualization Advisory - This advisory describes three vulnerabilities in the Siemens Teamcenter Visualization and JT2Go products.

INTRALOG Advisory - This advisory discusses two vulnerabilities in the Siemens INTRALOG warehouse management system (WMS).

SCALANCE Advisory - This advisory describes four vulnerabilities in the Siemens SCALANCE M-800 Family and RUGGEDCOM RM1224 products.

PTC Kepware Advisory - This advisory describes an allocation of resources without limit or throttling vulnerability in the PTC Kepware ThingWorx Kepware Server.

AVEVA Advisory - This advisory describes an SQL injection vulnerability in the AVEVA Historian Server.

 

For more information on these advisories, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-published-8-15-24 - subscription required. 

Review – 5 Advisories and 2 Updates Published

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Johnson Controls (3), Mitsubishi Electric, and Delta Electronics. They also updated advisories for products from Mitsubishi and PTC.

Advisories

Johnson Controls Advisory #1 - This advisory describes an incorrect default permissions vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #2 - This advisory describes a use of weak credentials vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #3 - This advisory discusses a dependency on vulnerable 3rd party component (JQuery) in the Johnson Controls Illustra Pro Gen 4 Camera.

Mitsubishi Advisory - This advisory describes an incorrect default permissions vulnerability in the Mitsubishi MELIPC Series MI5122-VW industrial PC.

Delta Advisory - This advisory describes four vulnerabilities in the Delta CNCSoft-G2.

Updates

Mitsubishi Update - This update provides additional information for the FA Engineering Software advisory that was originally published on September 26^th, 2023.

PTC Update - This update provides additional information for the PTC Creo Elements advisory that was originally published on June 25^th, 2024.

 

For more information on these advisories, including a down-the-rabbit-hole look at how CWE-1395 can hide the real extent of the 3^rd party vulnerabilities in a system, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-2-updates-published-a8a - subscription required.

Review – 2 Advisories Published – 6-25-24

Today, CISA’s NCCIC-ICS published two control system security advisories for products from PTC and ABB.

Advisories

PTC Advisory - This advisory describes a missing authentication vulnerability in the PTC Creo Elements Direct License Server.

ABB Advisory - This advisory describes an improper input validation vulnerability in the ABB 800xA Base services in PC based client/server nodes.

 

For more information on these advisories, including another Otorio reported vulnerability in the ABB product, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-published-6-25-24 - subscription required.

Review – 2 Advisories Published – 5-7-24

Today, CISA’s NCCIC-ICS published two control system security advisories for products from SUBNET and PTC.

Advisories

SUBNET Advisory - This advisory describes a reliance on insufficiently trustworthy components vulnerability in the SUBNET Substation Server.

PTC Advisory - This advisory describes a cross-site scripting vulnerability in the PTC Codebeamer application lifecycle management platform.

 

For more information on these advisories, including a down-the-rabbit-hole look at ‘insufficiently trustworthy components’, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-published-5-7-24 - subscription required.

GAO Reports – Week of 1-6-24 – Cost of Positive Train Control

This week the Government Accountability Office published a report on “GAO Reports – Week of 1-6-24 – Cost of Positive Train Control”. This report was required by §22409 of the Infrastructure Investment and Jobs Act (PL 117-58, 135 STAT. 740). In collecting information for this report from the commuter railroads, GAO found that most did not accurately breakout the operations and maintenance (O&M) costs for the positive train control systems that they are required to operate.

When Congress mandated PTC systems for all passenger railroads in 2008, everyone knew that it would be a costly system to implement. What Congress was looking for in this report, now that all passenger railroads have PTC systems in place, is what it was going to cost to maintain and run these systems. Unfortunately, it appears that the railroads have had little interest in tracking those costs.

What is missing, however, is what costs the freight railroads are having to keep up their PTC systems on lines transited by the most dangerous chemicals. This was not included in this report for the simple reason that Congress did not ask for it.

Review – 4 Advisories Published – 11-30-23

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Mitsubishi Electric, PTC, Yokogawa, and Delta Electronics.

Advisories

Mitsubishi Advisory - This advisory describes an external control of file name or path vulnerability in multiple Mitsubishi FA Engineering Software products.

PTC Advisory - This advisory describes two vulnerabilities in multiple PTC Kepware products.

Yokogawa Advisory - This advisory describes an uncontrolled resource consumption vulnerability in the Yokogawa STARDOM FCN/FCJ controller.

Delta Advisory - This advisory describes a stack-based buffer overflow vulnerability int e Delta DOPSoft product.

 

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-11-30-23 - subscription required. 

Review – 18 Advisories and 1 Updates Published

Today, CISA’s NCCIC-ICS published 16 control system security advisories for products from Schneider, Advantech, Hikvision, Mitsubishi, Weintek, and Siemens (11) and two medical device security advisories for products from Santesoft. They also updated an advisory for products from PTC.

Siemens published one additional advisory (and 11 updates) on Tuesday that were not covered here. CISA no longer updates their Siemens advisories. I will discuss all them this weekend in my Public ICS Disclosure blog post.

Advisories

Schneider Advisory - This advisory describes a missing authentication for critical function vulnerability in the Schneider Interactive Graphical SCADA System (IGSS).

Advantech Advisory - This advisory describes an exposure of sensitive information to an unauthorized actor vulnerability in the Advantech WebAccess product.

Hikvision Advisory - This advisory describes two vulnerabilities in the Hikvision Access Control and Intercom Products.

Mitsubishi Advisory - This advisory describes an improper authentication vulnerability in the Mitsubishi MELSEC-F Series main modules.

Weintek Advisory - This advisory describes three vulnerabilities in the Weintek cMT3000 CMI Web CGI.

Mendix Advisory - This advisory describes an observable discrepancy vulnerability in the Siemens Mendix Forgot Password Module.

Tecnomatix Advisory - This advisory describes seven vulnerabilities in the Siemens Tecnomatix Plant Simulation product.

SICAM Advisory #1 - This advisory describes a use of hard-coded credentials vulnerability in the Siemens CP-8050 and CP-8031 master modules.

SICAM Advisory #2 - This advisory describes an incorrect permission assignment for a critical resource vulnerability in the Siemens SICAM PAS/PQS.

SICAM Advisory #3 - This advisory describes a path traversal advisory vulnerability in the Siemens SICAM A8000 CP-8031 and CP-8050 master modules.

SINEC Advisory - This advisory describes two vulnerabilities in the Siemens SINEC NMS.

RUGGEDCOM Advisory - This advisory discusses seven vulnerabilities in the Siemens RUGGEDCOM APE1808.

Simcenter Advisory - This advisory describes a code injection vulnerability in the Siemens Simcenter Amesim product.

Xpedition Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Siemens Xpedition Layout Browser.

SCALANCE Advisory - This advisory discusses thirteen vulnerabilities in the Siemens SCALANCE W1750D.

SIMATIC Advisory - This advisory describes two vulnerabilities in the Siemens SIMATIC CP products.

Santesoft Advisory #1 - This advisory describes an out-of-bounds read vulnerability in the Santesoft Sante FFT Imaging.

Santesoft Advisory #2 - This advisory describes two vulnerabilities in the Santesoft Sante DICOM Viewer Pro.

Updates

PTC Update - This update provides additional information on an advisory that was originally published on August 31^st, 2023.

 

For more information on these advisories, including lists of missing vulnerabilities, links to 3^rd party advisories and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/18-advisories-and-1-updates-published - subscription required.

Review – 4 Advisories Published – 8-31-23

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Digi International, PTC, GE Digital, and ARDEREG.

Advisories

Digi Advisory - This advisory describes a use of password hash instead of password for authentication vulnerability in the Digi RealPort Protocol.

PTC Advisory - This advisory describes four vulnerabilities in the PTC Kepware KepServerEX.

GE Advisory - This advisory describes a process control vulnerability in the GE CIMPLICITY 2023 product.

ARDEREG Advisory - This advisory describes an SQL injection vulnerability in the ARDEREG Sistemas SCADA.

 

For more details on these advisories, including links to researcher reports and a down-the-rabbit-hole look at the Digi advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-8-31-23 - subscription required.

Review – 1 Advisory Published – 8-29-23

Today, CISA’s NCCIC-ICS published a control system security advisory for products from PTC.

Advisories

PTC Advisory - This advisory describes a cross-site scripting vulnerability in the PTC Codebeamer.

 

For more information on this advisory, including links to researcher report, see my Article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-published-8-29-23 - subscription required.

Review – 3 Advisories and 2 Updates Published – 7-27-23

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Mitsubishi Electric, PTC and ETIC Telecom. They also updated two advisories for products from Mitsubishi and ETIC.

Advisories

Mitsubishi Advisory - This advisory describes a classic buffer overflow vulnerability in the Mitsubishi CNC Series devices.

PTC Advisory - This advisory describes an uncontrolled resource consumption vulnerability in the PTC KEPServerEX.

ETIC Advisory - This advisory describes an insecure default initialization of resource vulnerability in the ETIC Remote Access Server (RAS).

Updates

Mitsubishi Update - This update provides additional information on an advisory that was originally published on August 9^th, 2022 and most recently updated on August 18^th, 2022 (not 8-16-23).

ETIC Update - This update provides additional information on an advisory that was originally published on November 11^th, 2022.

 

For more details about these advisories, including links to vendor advisories and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-2-updates-published-9a3 - subscription required.

Review – 15 Advisories Published – 5-11-23

VACATION DELAYED

Earlier this week, CISA’s NCCIC-ICS published 15 control system security advisories for products from Rockwell Automation (4), PTC, SDG, BirdDog, Teltonika, Sierra Wireless, and Siemens (6).

Advisories

Rockwell Advisory #1 - This advisory describes an inadequate encryption strength vulnerability in the Rockwell ThinManager, a software management platform.

Rockwell Advisory #2 - This advisory discusses two vulnerabilities in the Rockwell PanelView 800 graphics terminal.

Rockwell Advisory #3 - This advisory describes three incorrect restriction of operations within the bounds of a memory buffer vulnerabilities in the Rockwell Arena Simulation Software.

Rockwell Advisory #4 - This advisory describes an improper access control vulnerability in the Rockwell Kinetix 5500 EtherNet/IP Servo Drive.

PTC Advisory - This advisory describes six vulnerabilities in the PTC Vuforia Studio products.

SDG Advisory - This advisory describes an SQL injection vulnerability in the SDG PnPSCADA products.

BirdDog Advisory - This advisory describes two vulnerabilities in various BirdDog camera and encoder.

Teltonika Advisory - This advisory describes eight vulnerabilities in the Teltonika Remote Management System and RUT model routers.

Sierra Wireless Advisory - This advisory describes two vulnerabilities in the Sierra Wireless AirVantage cloud management platform.

Siemens Advisory #1 - This advisory describes four vulnerabilities in the Siemens SCALANCE LPE9403.

Siemens Advisory #2 - This advisory discusses nine vulnerabilities in the Siemens SINEC NMS.

Siemens Advisory #3 - This advisory describes seven vulnerabilities in the Siemens SIMATIC Cloud Connect 7 product.

Siemens Advisory #4 - This advisory describes two deserialization of untrusted data vulnerabilities in the Siemens Siveillance Video IP video management software.

Siemens Advisory #5 - This advisory discusses the Framing Frames vulnerability in the Siemens SCALANCE W1750D products.

Siemens Advisory #6 - This advisory describes three vulnerabilities in the Siemens Solid Edge SE2023 product.

 

For more details on these advisories, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/15-advisories-published-5-11-23 - subscription required –

Review - 1 Advisory and 2 Updates Published – 2-23-23

Today, CISA’s NCCIC-ICS published a control system security advisory for products from PTC. They also updated advisories for products from Moxa and BD.

Advisories

PTC Advisory - This advisory describes two vulnerabilities in the PTC ThingWorx Edge.

NOTE: NCCIC-ICS reports that products from Rockwell Automation and GE Digital are affected by these products.

Updates

Moxa Update - This update provides additional information on an advisory that was originally published on November 29^th, 2022.

BD Update - This update provides additional information on an advisory that was originally published on February 16^th, 2023.

 

For more on these advisories and updates, including list of other vendors affected and a summary of changes in the updates – see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-and-2-updates-published-c38 - subscription required.

Review – 2 Advisories and 2 Updates Published – 9-8-22

Today, CISA’s NCCIC-ICS published a control system security advisory for products from MZ Automation and a medical device security advisory for products from Baxter. They also updated advisories for products from PTC and Hillrom.

MZ Advisory - This advisory describes four vulnerabilities in the MZ Automation libIEC61850, a library for IEC 61850 implementation.

NOTE: Since this is a library product, the vulnerabilities are only exploitable in a product in which the library is used. So, we can expect to see this show up as third-party vulnerabilities in products from other vendors.

Baxter Advisory - This advisory discusses four vulnerabilities (with proof-of-concept code available) in the Sigma and Baxter Spectrum Infusion Pumps. The Baxter advisory notes that the vulnerabilities only affect the Spectrum Wireless Battery Module (WBM) that may be used by the infusion pumps.

PTC Update - This update provides new information on an advisory that was originally published on August 30^th, 2022.

Hillrom Update - This update provides new information on an advisory that was originally published on June 1^st, 2021 and most recently updated on December 14^th, 2021.

NOTE: The Hillrom advisory is nearly a duplicate of the CISA advisory (including the questionable use of the CISA seal), but it specifically mentions the December 14^th, 2021 update where the CISA advisory does not directly. I also like their use of the ‘Unclassified’ document marking.

 

For more details about these advisories and updates, including links to researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-2-updates-published - subscription required.

Review – 11 Advisories and 1 Update Published – 8-30-22

Today, CISA’s NCCIC-ICS published eleven control system security advisories for products from Johnson Control, PTC Kepware, Omron, Honeywell (3), Fuji Electric, and Hitachi Energy (4). They also updated an advisory for products from Mitsubishi Electric.

Johnson Control Advisory - This advisory describes a command injection vulnerability in the Johnson Control (Tyco subsidiary) iSTAR Ultra door controller.

PTC Advisory - This advisory describes two vulnerabilities on the Kepware KEPServerEX connectivity platform.

NOTE: NCCIC-ICS reports that these vulnerabilities also affect the following products as thirdparty vulnerabilities:

• Rockwell Automation KEPServer Enterprise,

• GE Digital Industrial Gateway Server, and

• Software Toolbox TOP Server

Honeywell Advisory #1 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Trend Controls IQ Series IC.

Honeywell Advisory #2 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Experion LX distributed control system.

Honeywell Advisory #3 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell ControlEdge PLC.

Fuji Advisory - This advisory describes two vulnerabilities in the Fuji D300win programming support tool.

Hitachi Energy Advisory #1 - This advisory describes an improper input validation vulnerability in the Hitachi Energy RTU500.

Hitachi Energy Advisory #2 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy MSM Product.

NOTE: I briefly discussed the 13 underlying vulnerabilities (3 with known exploits) on July 16^th, 2022.

Hitachi Energy Advisory #3 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy Gateway Station product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Hitachi Energy Advisory #4 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy FACTS Control Platform product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Mitsubishi Update - This update provides additional information for an advisory that was originally published on August 9th, 2022 and most recently updated on August 18^th, 2022.

 

For more details on these advisories and the update, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published - subscription required.

Review – 7 Advisories and 2 Updates Published – 3-31-22

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Rockwell Automation (2), General Electric Renewables, Mitsubishi Electric, Fuji Electric, Hitachi Energy, and Schneider Electric. They also updated to advisories for products from Mitsubishi and PTC.

Rockwell Advisory #1 - This advisory describes a code injection vulnerability in the Rockwell Studio 5000 Logix Designer.

Rockwell Advisory #2 - This advisory describes an inclusion of functionality from an untrusted control sphere vulnerability in the Rockwell Logix Controllers.

Commentary: Claroty’s report on both of these vulnerabilities makes an important point about these (and previously-reported similar vulnerabilities in other vendor PLCs):

“Successful stealthy exploits of programmable logic controllers (PLCs) are among the rarest, most time-consuming, and investment-heavy attacks. Stuxnet’s authors established the playbook for hacking PLCs by figuring out how to conceal malicious bytecode running on a PLC while the engineer programming the controller sees only normalcy on their engineering workstation. Without advanced forensics utilities, the execution of such malicious code cannot be discovered. [emphasis added]”

General Electric Advisory - This advisory describes six vulnerabilities (one third-party vulnerability with known exploit) in the General Electric MDS iNET/iNETII/SD/TD220/ TD220MAX Radios.

Mitsubishi Advisory - This advisory describes six vulnerabilities in the Mitsubishi FA CPU module products.

Fuji Advisory - This advisory describes five vulnerabilities in the Fuji Alpha5 servo drive system.

NOTE: I reported on four of the five ZDI advisories that form the basis for this advisory back in October, 2021. Those advisories were recently updated (March 23, 2022) to include the CVE numbers.

Hitachi Energy Advisory - This advisory describes four vulnerabilities in the Hitachi Energy e-mesh EMS optimizer software for energy resources.

NOTE: I briefly reported on the underlying Hitachi Energy advisory on January 15^th, 2022. This advisory is based on the recent update that revised the CVSS Base Score and Vector.

Schneider Advisory - This advisory describes an improper restriction of XML external entity reference in the Schneider SCADAPack Workbench software.

Mitsubishi Update - This update provides additional information on an advisory that was originally published on October 29^th, 2020 and most recently updated on January 13^th, 2022.

PTC Update - This update provides additional information on an advisory that was originally published on March 8^th, 2022 and most recently updated on March 15^th, 2022.

 

For more details on these advisories, including links to researcher reports, third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-2-updates-published - subscription required.

Review – 1 Advisory and 1 Update Published – 3-15-22

Today CISA’s NCCIC-ICS published a control system security advisory for products from ABB. They also updated an advisory for products from PTC.

ABB Advisory - This advisory describes an execution with unnecessary privileges vulnerability in the ABB OPC Server for AC 800M.

NOTE: I briefly discussed this vulnerability back on February 5^th, 2022.

PTC Update - This update provides additional information on an advisory (Access:7) that was originally published on March 8^th, 2022 and most recently updated on March 10^th, 2022.

 

For more details on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-and-1-update-published-ded - subscription required.

Review – 11 Updates Published – 3-10-22

Yesterday, CISA’s NCCIC-ICS updated eleven control-system security advisories for products from Wibu Systems, PTC, and Siemens (9). Siemens published eight additional updates on Tuesday which I will address this weekend.

Wibu-Systems Update - This update provides additional information on an advisory that was originally published on September 8^th, 2020 and most recently updated on February 11^th, 2021.

PTC Update - This update provides additional information on an advisory that was originally published on March 8^th, 2022.

NOTE: There is a typo in the link for the Agilent advisory provided in the Update.

Industrial Products Update #1 - This update provides additional information on an advisory that was originally published on September 10^th, 2019 and most recently updated on September 14^th, 2021.

Industrial Products Update #2 - This update provides additional information on an advisory that was originally published on September 8^th, 2020 and most recently updated on June 8^th, 2021

Industrial Products Update #3 - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

SIMOTICS Update - This update provides additional information on an advisory that was originally published on April 13^th, 2021.

Climatix Update - This update provides additional information on an advisory that was originally published on November 11^th, 2021.

SIMATIC Update #1 - This update provides additional information on an advisory that was originally published on November 11^th, 2021 and most recently updated on February 10^th, 2022.

SIMATIC Update #2 - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

Solid Edge Update - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

SICAM Update - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

 

For more information on these updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-updates-published-3-10-22 - subscription required.

Review – 2 Advisories and 1 Update Published – 3-8-22

Today, CISA’s NCCIC-ICS published two control system security advisories for products from AVEVA and PTC. They also published an update for an advisory from Johnson Controls.

AVEVA Advisory - This advisory describes a cleartext storage of sensitive information vulnerability in the AVEVA System Platform.

NOTE: I briefly discussed this vulnerability on February 19^th, 2022.

PTC Advisory - This advisory describes seven vulnerabilities in the PTC Axeda agent and Axeda Desktop Server.

NOTE: MDX/Forescout provides a list of 150 medical devices that may be affected by Access:7. We should be seeing a lot more vendors reporting on this vulnerability.

Johnson Controls Update - This update provides additional information on an advisory that was originally published on February 3^rd, 2022.

 

For more details about these vulnerabilities, including links to researcher reports, see may article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-1-update-published-ecd - subscription required.

Review - FRA Publishes PTC Safety Advisory – 9-2-21

Today the DOT’s Federal Railroad Administration published a notice of safety advisory in the Federal Register (86 FR 49410-49411) for “Positive Train Control Interface Design Issue With Locomotive and Cab Car Braking Systems”. Safety Advisory 2021-01 was published due to the identification of the availability of a manual bypass of the PTC breaking controls on at least two different PTC systems.

It is easy to imagine circumstances where being able to defeat the PTC’s operation of breaking controls would be necessary. The system to defeat that system should not, however, be readily available to the train crew. Management review of the circumstances needs to be undertaken to ensure that the safety of the train, the crew and the public is protected.

For more details on the problem and FRA required actions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/fra-publishes-ptc-safety-advisory - subscription required.