Multiple ICS Vulnerabilities Enable RCE and Takeover

Multiple high-severity vulnerabilities have been identified across Honeywell CCTV Products, GE Vernova Enervista UR Setup, Delta Electronics ASDA-Soft, and Siemens Simcenter Femap and Nastran. Successful exploitation could lead to account takeover, unauthorised access, remote code execution (RCE), buffer overflows, file system manipulation, or application crashes.

CVE

CVE-2026-1670
CVE-2026-1762
CVE-2026-1763
CVE-2026-1361
CVE-2026-23715–CVE-2026-23720

Targeting / Delivery Mechanism

• Honeywell CCTV: Exploitation via unauthenticated API endpoint exposure, allowing attackers to modify password recovery settings.
• GE Enervista UR Setup: Exploitable through malicious DLL placement or crafted firmware update files.
• Delta ASDA-Soft: Triggered by malicious .par files causing buffer overflow.
• Siemens Simcenter: Exploitation requires user interaction by opening malicious NDB or XDB files.

Internet-facing systems, exposed management interfaces, and environments where users handle untrusted files present elevated risk.

Execution Technique

• Missing authentication enabling account takeover (Honeywell).
• DLL hijacking and directory traversal enabling elevated code execution (GE).
• Stack-based buffer overflow leading to structured exception handler corruption (Delta).
• Out-of-bounds read/write and heap-based buffer overflows through malicious file parsing (Siemens).

Persistence / Deployment

Successful exploitation could allow attackers to gain administrative access, execute arbitrary code, manipulate system configurations, access surveillance feeds, or maintain persistence within operational technology environments.