Review – Public ICS Disclosures – Week of 9-13-25 – Part 1

This was a moderately busy disclosure week. For Part 1 we have 12 vendor disclosures from Dassault Systems (3), Eaton (2), Hitachi, HP (2), and HPE (4).

Advisories

Dassault Advisory #1 - Dassault published an advisory that describes the use of an uninitialized variable vulnerability in their SOLIDWORKS Desktop 2025.

Dassault Advisory #2 - Dassault published an advisory that describes a use after free vulnerability in their SOLIDWORKS Desktop 2025.

Dassault Advisory #3 - Dassault published an advisory that describes an out-of-bounds read vulnerability in their SOLIDWORKS Desktop 2025.

Eaton Advisory #1 - Eaton published an advisory that describes two path traversal vulnerabilities in their Network Cards products.

Eaton Advisory #2 - Eaton published an advisory that describes two vulnerabilities in their Rack PDU G4 products.

Hitachi Advisory - Hitachi published an advisory that discusses 46 vulnerabilities in their Disk Array products.

HP Advisory #1 - HP published an advisory that describes an OS command injection vulnerability in their HyperX NGENUITY software.

HP Advisory #2 - HP published an advisory that discusses eight vulnerabilities in multiple HP products.

HPE Advisory #1 - HPE published an advisory that discusses 13 vulnerabilities (five with publicly available exploits) in their Telco Intelligent Assurance product.

HPE Advisory #2 - HPE published an advisory that describes a cross-site scripting vulnerability in their Aruba ClearPass Policy Manager.

HPE Advisory #3 - HPE published an advisory that discusses three vulnerabilities in their Telco Service Activator product.

HPE Advisory #4 - HPE published an advisory that describes nine vulnerabilities in their Aruba Networking EdgeConnect SD-WAN Gateways.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-403 - subscription required

Short Takes – 9-19-25 – Space Geek Edition

Starship will soon fly over towns and cities, but will dodge the biggest ones. ArsTechnica.com article. Pull quote: “The FAA released a document Friday describing SpaceX's request to update its government license for additional Starship launch and reentry trajectories. The document is a draft version of a "tiered environmental assessment" examining the potential for significant environmental impacts from the new launch and reentry flight paths.”

New military satcom services program to focus on ‘maneuverable’ small GEO satellites. SpaceNews.com article. Pull quote: “The document also highlighted a shift in the commercial satcom market, which has moved away from leasing raw transponder capacity toward managed services. That change, while commercially efficient, poses a challenge for the military, since many of its secure waveforms are incompatible with managed services.”

Cygnus cargo ship set to rendezvous with space station after delay. CBSNews.com article. Pull quote: “Sunday's launch was the third of at least four SpaceX flights purchased by Northrop Grumman while the company recovers from the transit setback and presses ahead with work to develop a new booster of its own.”

Northrop Grumman successfully resupplies ISS after overcoming software glitch. ArsTechnica.com article. Pull quote: “NASA announced on Wednesday that the [early engine shutdown] problem would prevent the spacecraft from reaching the ISS as scheduled. Engineers ultimately determined the engine's early shutdown was caused by onboard software designed to protect the spacecraft from a potential problem.”

Astra plans mid-2026 first launch of Rocket 4. SpaceNews.com article. Pull quote: “The vehicle will initially be capable of placing about 750 kilograms into low Earth orbit for a price of $5 million. “That’ll be very competitive,” he said in an interview after the presentation, similar to what SpaceX charges for payloads of that size through its rideshare program. “At this point, I think that’s a nice target for us to have.””

A new report finds China’s space program will soon equal that of the US. ArsTechnica.com article. Pull quote: “Roll is the co-author of a new report, titled "Redshift," on the acceleration of China's commercial and civil space activities and the threat these pose to similar efforts in the United States. Published on Tuesday, the report was sponsored by the US-based Commercial Space Federation, which advocates for the country's commercial space industry. It is a sobering read and comes as China not only projects to land humans on the lunar surface before the US can return, but also is advancing across several spaceflight fronts to challenge America.”

Review - Bills Introduced – 9-18-25

With both the House and Senate in session and preparing to leave Washington for a week, there were 151 bills introduced. Three of those bills will receive additional coverage in this blog:

HR 5450 Making continuing appropriations for the fiscal year ending September 30, 2026, and for other purposes. DeLauro, Rosa L. [Rep.-D-CT-3]

S 2866 A bill to amend the National Agricultural Research, Extension, and Teaching Policy Act of 1977 to direct the Secretary of Agriculture to establish a program providing for the establishment of Agriculture Cybersecurity Centers, and for other purposes. Budd, Ted [Sen.-R-NC]

S 2882 A bill making continuing appropriations for the fiscal year ending September 30, 2026, and for other purposes. Murray, Patty [Sen.-D-WA] 

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

S 2888 A bill to amend chapter 511 of title 51, United States Code, to modify the authority for space transportation infrastructure modernization grants, and for other purposes. Sen. Hickenlooper, John W. [D-CO]

 

For more information on these bills, including legislative history for similar bills in the 118th, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-9-18-25 - subscription required.

OMB Concluded Action on EPA TSCA Risk Assessment NPRM – 9-18-25

Yesterday the OMB’s Office of Information and Regulatory Affair (OIRA) announced that it had concluded action on a notice of proposed rulemaking from the EPA on “Further Reconsideration of Procedures for Chemical Risk Evaluation Under the Toxic Substances Control Act (TSCA)”. The NPRM was submitted to OIRA on August 4^th, 2025.

According to the Spring 2025 Unified Agenda entry for this rulemaking:

“On May 3, 2024, the Environmental Protection Agency (EPA or the Agency) promulgated amendments to the procedural framework rule for conducting risk evaluations under the Toxic Substances Control Act (TSCA). The purpose of risk evaluations under TSCA is to determine whether a chemical substance presents an unreasonable risk of injury to health or the environment under its conditions of use, without consideration of costs or non-risk factors, including unreasonable risk to potentially exposed or susceptible subpopulations identified as relevant to the risk evaluation by EPA. Some aspects of the 2024 amendments were necessary to align with court decisions from 2019. EPA is initiating further rulemaking to reexamine multiple aspects of the 2024 rulemaking for consistency with the law and Administration policy.”

The concluding action is listed as: “Statutory or Judicial Deadline”.

I do not expect to provide and detailed coverage of this rulemaking, but I will be announcing its publication in the appropriate ‘Short Takes’ post.

Transportation Chemical Incidents – Week of 8-16-25

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 562 (521 highway, 36 air, 5 rail, 0 water)

• Serious incidents – 8 (7 Bulk release, 1 evacuation, 3 injury, 0 death, 0 major artery closed, 0 fire/explosion, 36 no release)

• Largest container involved – 28,810-gal DOT 117J100W Railcar {Ethanol Or Ethyl Alcohol Or Ethanol Solutions Or Ethyl Alcohol Solutions} vapor valve was in the open position and the camlock cap was not installed.

• Largest amount spilled – 16,520-gal 204W (?) Railcar {Argon, Refrigerated Liquid (Cryogenic Liquid)} Release from the backside of the gage assembly causing liquid to release.

• Total amount reported spilled in all incidents – 19,842.6 gal

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Difluoromethane: A colorless odorless gas. Insoluble in water and has a high thermal stability. Its vapors are heavier than air. Under prolonged exposure to fire or intense heat the containers may rupture violently and rocket. Contact with the unconfined liquid can cause frostbite. Used as a refrigerant. (Source: CameoChemicals.NOAA.gov).

 

Review - FERC Sends Sunset Provisions Direct Final Rule to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a direct final rule from the Federal Energy Regulatory Commission (FERC) on “Implementation of the Executive Order [EO 14270] Entitled ‘Zero-Based Regulatory Budgeting to Unleash American Energy’”. This rule was not listed in the Spring 2025 Unified Agenda. Without the information that would be provided in a UA rulemaking listing, we can only guess that this rule would implement the sunset provisions of section 4 of  EO 14270 for all covered existing FERC regulations.

 

For a discussion about the ‘sunset rule’ provisions of EO 14270, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ferc-sends-sunset-provisions-direct - subscription required.

HR 5371 Not Considered in House – FY 2026 CR

This evening the House adjourned without taking up HR 5371, the Continuing Appropriations and Extensions Act, 2026. The rule for the consideration of the bill (H Res 722) approved in the House yesterday evening by a vote of 216 to 210 with one Republican voting ‘Present’. The vote on HR 5371 was expected today, but the failure of the House to even begin consideration today almost certainly means that there were not sufficient Republican votes to pass the bill. The House will be in session tomorrow, so an early vote could take place then, but only if the leadership thinks that they have the votes to pass the bill.

While the current government funding through midnight on September 30^th, both the House and Senate are scheduled to be out of Washington, DC, next week in recognition of Rosh Hashanah (Monday through Thursday). This would leave just two days (the 29^th, and 30^th) to get a bill passed through both the House and Senate to prevent a government shutdown on Wednesday, October 1^st.

Reporting on X was that the Senate would be voting on HR 5371 (expected to fail) and then a Democratic alternative (also expected to fail). Apparently ‘negotiations’ would take place over the break with a fresh vote on the 29^th.