Review – 7 Advisories and 2 Updates Published – 8-25-26

Today CISA’s NCCIC-ICS published 7 control system security advisories for products from Furuno, Ebyte, Bendix, PayRange, Siemens, Zoneminder, and Rently. They also updated advisories for products from Lantronix and Optigo. 

Advisories  

Furuno Advisory - This advisory describes two vulnerabilities in the FURUNO FA-50 Class B AIS Transponder. The vulnerabilities were reported to CISA by Souvik Kandar. 

Ebyte Advisory - This advisory describes 11 vulnerabilities in the Ebyte NE2-D11 Firmware FW-9167-0-11. The vulnerability was reported to CISA by Jithin Nambiar. 

Bendix Advisory - This advisory describes three vulnerabilities in the Bendix EC80 Brake ECU. The vulnerabilities were reported to CISA by Ben Gardiner of NMFTA. 

PayRange Advisory - This advisory describes a missing authorization vulnerability in the PayRange API. The vulnerability was reported to CISA by Tahi Wilton Geary. 

Siemens Advisory - This advisory describes a missing authentication for critical function vulnerability in the Siemens SIMATIC IoT2050 Advanced. The vulnerability was self-reported. 

Zoneminder Advisory - This advisory describes an OS command injection vulnerability in the Zoneminder video surveillance system. Scriptkittens published an exploit for this vulnerability.  

Rently Advisory - This advisory describes an insufficiently protected credentials vulnerability in the Rently Smart Home. The vulnerability was reported to CISA by Berk Dusunur. 

Updates  

Lantronix Update - This update provides additional information on the Lantronix EDS3000PS advisory that was originally published on March 10th, 2026. 

Optigo Update - This update provides additional information on the Visual BACnet Capture Tool advisory that was originally published on March 11th, 2025. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-2-updates-published-054 - subscription required. 

Reveiw - HR 10108 Introduced – Hazmat Transparency Act

Earlier this month, Rep Tran (D,CA) introduced HR 10108, the Hazardous Materials Transparency Act. The bill would require DOD to establish guidance governing community engagement and emergency preparedness practices for covered defense industrial facilities. A periodic report to Congress would also be required. No new funding is authorized in this legislation. 

I can find no legislation in the 118th Congress that is similar to HR 10108. A press release from Tran’s office reports that:  

“U.S. Representative Derek Tran (CA-45) introduced new legislation to require additional transparency and accountability measures for industrial facilities that handle hazardous materials. H.R. 10108, the Hazardous Materials Transparency Act, mandates that these facilities properly and regularly notify the communities they operate in about the safety measures that are taken to avoid danger to residents and small businesses. The bill also requires facilities working with hazardous materials to establish a coordination plan with first responders and to have a community liaison able to provide timely information in the case of an emergency. This legislation was introduced in response to the chemical crisis at the GKN Aerospace facility in Garden Grove that displaced over 50,000 residents and shuttered 5,000 small businesses over Memorial Day Weekend.” 

Moving Forward  

Tran is a member of the House Armed Services Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see the bill considered by that Committee. There will be some level of opposition to the requirements of this bill from Republican members, being concerned about the national security implications about information sharing. I suspect, however, that there may be sufficient support to see the bill move forward out of committee. There will not, however, be sufficient backing to see the bill move to the full House under the suspension of the rules process. 

For more information on the provision of this bill, including a commentary on potential accident investigations, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-10108-introduced-hazmat-transparency - subscription required. 

Short Takes – 8-25-26 - Federal Register Edition

TSCA Findings  

Certain New Chemicals or Significant New Uses; Statements of Findings-May 2026. EPA TSCA finding notice. Summary: “In this unit, EPA identifies the PMNs, MCANs and SNUNs for which EPA has made findings under TSCA section 5(a)(3)(C) that the new chemical substances or significant new uses are not likely to present an unreasonable risk of injury to health or the environment. For the findings made during this period, the following list provides the EPA case number assigned to the TSCA section 5(a) submission and the chemical identity (generic name if the specific name is claimed as confidential). 

• “P-26-0024, Maleated polyalkene, aminoethyl substituted heteromonocycle, carbopolycycle alkoxylated (Generic Name). 
• “J-26-0001, ModifiedSaccharomyces cerevisiae for improved production of ethanol (Generic Name).” 

UAS Imports  

Comment Sought on Prohibiting the Importation and Marketing of Certain Covered UAS and UAS Critical Components and Equipment Listed in Section 1709 of FY2025 NDAA. FCC request for comments. Summary: “In this document, the Public Safety and Homeland Security Bureau (PSHSB) and the Office of Engineering and Technology (OET) seek comment on proposing to prohibit the continued importation and marketing of certain previously authorized equipment that has been determined to pose an unacceptable risk to the national security of the United States and to the safety and security of United States persons. Through this Public Notice, PSHSB and OET propose to apply such prohibitions to certain previously-authorized foreign-produced uncrewed aircraft systems (UAS) and UAS critical components, and certain communications and video surveillance equipment listed in section 1709 of the Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025 (FY2025 NDAA), added to the Covered List in December 2025.”  

ICR Notices  

30-Day Notice of Intent To Seek Extension of Approval of Collection: Dispute Resolution Procedures Under the Fixing America's Surface Transportation Act. STB 30-day ICR extension notice. Summary: “As required by the Paperwork Reduction Act of 1995 (PRA), the Surface Transportation Board (STB or Board) gives notice of its intent to seek approval from the Office of Management and Budget (OMB) for an extension of the collection of “FAST Act” Dispute Resolution Procedures, as described below.” 

Space Geek  

Siting New Spaceports and Use of Priority Airspace for Critical Space Launch Corridors. FAA request for information. Summary: “Under the leadership of President Trump and at the direction of Secretary Duffy and Administrator Bedford, the U.S. Department of Transportation (DOT) and the Federal Aviation Administration (FAA) are pursuing opportunities to ensure the United States global dominance in the commercial space transportation industry. The FAA is issuing this RFI to solicit public and industry input on two key transportation-related elements of President Trump's recently published 2026 National Space Transportation Policy (NSTP): siting a new spaceport and the development and use of priority airspace for critical space launch corridors.” 

The National Space Transportation Policy. EOP National Security Presidential Memorandum 17. 

Review - TSA Sends HMI Threat Assessment ICR to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an extension without change of a currently approved collection from the DHS’ Transportation Security Administration for their “Security Threat Assessment for Individuals Applying for a Hazardous Materials Endorsement for a Commercial Driver's License” information collection request (ICR). The 30-day ICR notice was published earlier this week in the Federal Register (91 FR 53889-53890). The 60-day ICR notice was published on May 6th, 2026. 

The OMB reports that the following burden estimate data was provided to them by the TSA: 

Public Comments  

TSA and OIRA are soliciting public comments on the data being provided in the 30-day ICR notice that is currently being reviewed by OIRA. Comments may be submitted by going to OIRA’s Agency Submission page for this ICR and clicking on the “COMMENT” button near the top of the page. Comments should be submitted by September 21st, 2026. 

Commentary  

While not a function of the information collection process, the generally declining number of applicants and renewal requests reported by TSA for these security threat assessments for CDL hazardous materials indorsements presages an increasing problem for the chemical industry. The chemical industry can ill afford to deal with a declining number of truck drivers that are legally qualified to haul hazardous material loads. Industry is going to have to become more actively involved in recruiting truck drivers in general and HMI qualified drivers in particular.