Oshili PowerThe retail calendar calls the Monday after a long weekend Cyber Monday and fills it with discounts. The industrial calendar does not. In recent weeks twenty advisories about the systems that run substations, plant rooms, pipelines and control rooms were written up on this site, and not one of them was offered to this audience. So this is the first Cyber Monday. Nothing is on sale. Everything is in stock.
Twenty briefs. Seventy nine CVE identifiers between them. A top base score of 8.8. Sixteen vendors and open source projects, from the substation gateway to the camera in the plant room. Read them in the order a power user would feel them.
Where the grid is controlled
The first group lives in the substation and the control room, the part of the estate that a large power user shares with its utility and its wheeling counterparty.
- A server login can alter grid control room data without the control system's own password. Hitachi Energy MicroSCADA X SYS600, three identifiers, the highest scored 8.5.
- A substation unit is patched, though sites on older firmware must upgrade or wait. Hitachi Energy RTU500, nine identifiers in one advisory, scored to 8.8.
- Eight flaws in a common IEC 61850 library end in the same crash. MZ Automation libIEC61850, the protocol stack inside more substation products than most owners can list.
- A crafted telecontrol frame can crash devices running lib60870 2.4.0. The sibling library for IEC 60870, the telecontrol protocol between RTUs and the control centre.
- A read-only login is enough to write files on a network management host. Satel NetCo Design, four identifiers, scored to 8.8.
If your supply is wheeled, these are the systems between the generator and your busbar. You do not operate them. You depend on them.
Where the plant is run
The second group is the plant floor: the controllers, gateways, drivers and SCADA servers that a mine or a smelter does operate itself.
- A remote request can pull keys and passwords out of two Siemens plant systems. Siemens SIMOVE FleetManager and SIPLANT.
- A low-level login can end up running code on the control room's server. Inductive Automation Ignition, scored 8.7.
- An industrial gateway was handing out the keys to its own traffic. Moxa AIG-302 and ThingsPro Edge, scored to 8.6.
- Industrial network switches can be taken over without a password. Red Lion N-Tron 700 series, seven identifiers, an update to an earlier advisory.
- An unauthenticated debug service gives root on two Toptech controllers. Toptech RCU II and MultiLoad II, the controllers at fuel loading racks.
- A retired controller platform will not be patched, so the only fix is a migration. OpenPLC Runtime v3.
- A driver that ships with industrial adapters can crash the Windows machine it runs on. HMS Networks PEAK-System PCAN drivers, six identifiers.
- A defect in shared networking code can knock small control devices offline, and only your supplier can fix it. lwIP, the TCP/IP stack embedded in devices that never show its name.
- Six defects in a shared industrial data component, and the oldest installations get no patch of their own. Eclipse Milo, the OPC UA stack, scored to 8.2.
Two of these fourteen are libraries and one is a driver, not products. A library flaw is a flaw in every product that embeds it, including the ones whose vendor has not yet said so.
Where the plant is watched
The third group is the equipment that watches the equipment: the camera, the rack monitor, the power monitor, the pipeline monitor.
- A common security camera hands over its live video, and its maker is not answering. Carecam CM2507, seven identifiers and no vendor response.
- A tampered backup file can take over the monitor watching a plant room. Schneider Electric NetBotz 750 and 755.
- A power monitor's fix ships as two files, and the units in the field accept only one. Tycon TPDIN Monitor Web3, scored to 8.8.
- Saved files from a pipeline monitoring system can give up their users' passwords. AVEVA Pipeline Integrity Monitor, four identifiers, scored to 8.4.
Monitoring systems sit on the network with a view of everything and a security budget of almost nothing. They are where an intruder goes to learn the site before touching it.
Who is coming through the door
The last two briefs are not about a product. They are about the people using the products above.
- The list of software flaws under active attack now reaches the engineering desk. Six additions to the Known Exploited Vulnerabilities catalogue in one notice.
- Six agencies map a ransomware group that wipes the backups before asking for money. The SafePay advisory, five identifiers used on the way in.
For large power users
Twenty advisories in a few weeks is not a crisis. It is the normal rate, and that is the point. A site that reads them one at a time sees noise; a site that reads them together sees the shape of its own estate: which vendors it runs, which libraries it did not know it ran, which monitors it never patched because nobody owned them.
Three questions worth asking before the next twenty arrive. Which of the sixteen names above appear in your asset register, and which appear on your site but not in the register? Who in your organisation is the named owner of the monitoring layer, the cameras and rack monitors and power meters that are nobody's job? And for the systems you do not operate but depend on, the substation and the wheeling path, what has your supplier told you about any of the five briefs in the first group?
Every brief above cites its primary advisory. Each one takes about two minutes to read.
Sources
- Oshili Power advisory briefs, each linked below, with the primary CISA or vendor advisory cited inside each brief