Today CISA’s NCCIC-ICS published 11 control system security advisories for products from MZ Automation (2), Watchfire, 06 Automation, Mitsubishi Electric, NASA, Rockwell Automation, Schneider Electric, Toptech, Johnson Controls, and MikroTik. They also updated an advisory for products from Hardy Barth. I also took down-the-rabbit-hole looks at other Johnson Controls advisories and Hardy Barth communications.
Advisory Summaries
MZ Automation Advisory #1 - This advisory describes two vulnerabilities in the MZ Automation lib60870.
MZ Automation Advisory #2 - This advisory describes eight vulnerabilities in the MZ Automation GmbH libiec61850.
Watchfire Advisory - This advisory describes a hard-coded cryptographic key vulnerability in the Watchfire Controller Software.
06 Automation Advisory - This advisory describes four vulnerabilities in the o6 Automation open62541 OPC UA stack.
Mitsubishi Advisory - This advisory describes an improper enforcement of message integrity during transmission in a communication channel vulnerability in the Mitsubishi CC-Link IE TSN Communication Protocol.
NASA Advisory - This advisory describes a NULL pointer dereference vulnerability in the NASA Core Flight System (cFS) Health & Safety (HS) Application.
NOTE: This vulnerability is related to an incomplete fix for CVE 2026-15352.
Rockwell Advisory - This advisory describes an improper check for certificate revocation vulnerability in the Rockwell CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module.
Schneider Advisory - This advisory describes an out-of-bounds write vulnerability in the Schneider IGSS.
Toptech Advisory - This advisory describes a missing authentication for critical function vulnerability in the Toptech Systems RCU II+ and Multiload II+.
Johnson Controls Advisory - This advisory describes three vulnerabilities in the Johnson Controls OpenBlue Employee smart building ecosystem.
MikroTik Advisory - This advisory describes an insufficient session expiration vulnerability in the MikroTik RouterOS.
Update Summaries
Hardy Barth Update
This update provides additional information on the Salia EV Charge Controller advisory that was originally published on April 21st, 2026.
DTRH Other Johnson Controls Advisories
On July 23rd, 2026, Johnson Controls published five control system security advisories. Two were covered last week by CISA (ICSA-26-204-02 and ICSA-26-204-01). Those, along with the one today (JCI-PSA-2026-09) leave two advisories that have yet to be addressed by CISA:
victor Web, JCI-PSA-2026-16, and
victor Web, JCI-PSA-2026-07
DTRH Hardy Barth Follow-up
When CISA published the original advisory back in April, they reported that: “The vendor was contacted early about this disclosure but did not respond in any way.” That statement was removed from today’s updated version of the advisory; nothing unusual there and there is no sense in flogging a vendor that has started to respond. Except.... CISA notes in the Revision History that: “Update A - Added corrective actions taken by Hardy Barth as provided to BSI.”
So, while Hardy Barth has taken corrective action, it seems like they are still not talking to CISA. To be fair, they are a German company and BSI (Bundesamt für Sicherheit in der Informationstechnik, the German office for information security) is the local equivalent of CISA. So, if they must coordinate with someone, BIS appears to be the appropriate agency.
The good thing is that it appears that BIS and CISA are talking with each other.