MDR
Solutions
Partners
About
Resources
Affected Environment
HMS PEAK-System PCAN Windows drivers, Moxa AIG-302 ThingsPro Edge, Hitachi Energy MicroSCADA X SYS600, and RTU500 firmware.
Threat Overview
Flaws enable kernel crashes, denial of service, key disclosure, authentication bypass, and privilege escalation; highest CVSS v3 is 8.8 (RTU500).
Exposure Timeline
Advisories issued 20 October 2026; fixes include PCAN 5.1.4, Moxa v1.4.1, SYS600 10.8, and RTU500 13.9.1.
Attack Surface
Windows CAN drivers, Moxa device APIs, SYS600 servers and engineering tools, and RTU500 web and XML services.
Technical Root Cause
Buffer overflows, missing authorisation, hard-coded cryptographic key, CSV injection, and flaws in libcurl, libxml2, and OpenSSL components.
Exploitation Pathway
Crafted driver records, adjacent network access to Moxa devices, OS-authenticated SYS600 users, and crafted XML or certificate data against RTU500.
Operational Impact
Windows kernel crashes, device denial of service, credential and key exposure, host privilege escalation, and interrupted IEC 60870-5-104 communication.
Strategic Impact
Energy and industrial operators face availability and integrity risk to control systems, heightened where OT networks are exposed or flat.
Required Mitigation
Upgrade PCAN to 5.1.4, Moxa AIG-302 to v1.4.1, SYS600 to 10.8, and RTU500 to fixed firmware; segment control networks.
Incident Response Guidance
Confirm control systems are not internet accessible, review SYS600 logons and logs, monitor OT traffic, and scan removable media.
References
CISA ICS Advisories ICSA-26-293-01, ICSA-26-293-03, ICSA-26-293-04, ICSA-26-293-05.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)