Security Notices
CISA Details ABB PCM600 Scheduler Privilege Risks
CISA's PCM600 notice distinguishes Scheduler privilege escalation from project-archive path traversal. Apply the documented service-account workaround under engineering change control, retain certificate safeguards, and do not mark the underlying defect patched merely because the account changed.
Armatura One Updates Fix Critical Code Execution and Credential Flaws
Armatura One updates address an embedded ActiveMQ code-execution flaw and several credential exposures. Match the standard or USA branch, preserve evidence and assess exposed secrets; known exploitation of ActiveMQ does not prove compromise of a particular installation.
CISA Malcolm Update Addresses Fifteen Security Vulnerabilities
Malcolm updates address fifteen authentication, command, archive and credential-handling issues. Confirm the supported release mapping and explicitly configure KEYCLOAK_SSL_VERIFY; upgrading alone does not enable the added identity-provider certificate check or validate retained sensor coverage.
Johnson Controls Releases EasyIO Neo Firmware and Hardware Fixes
EasyIO Neo remediation requires both model-specific firmware and, for debug-interface findings, revised hardware. Confirm replacement hardware with the vendor and coordinate facilities maintenance; installing a matching firmware number on old hardware does not remove physical debug pins.
CISA Warns of Missing Authorization in Meari IoT Cloud Platform
Meari IoT Cloud OpenAPI authorization flaws can expose or alter another owner's device data through authenticated accounts. CISA records no planned fix; confirm provider disposition and assess dependencies before disconnection, without treating local segmentation as cloud remediation.
CISA Warns of Critical Authentication Gaps in Monta Charging Services
Monta charging-service weaknesses require provider-confirmed controls and authenticated station connections using OCPP Security Profile 2. Coordinate migration with station vendors and operations; an app update or TLS without station authentication does not establish remediation.
Johnson Controls Warns of High-Severity EasyIO FG Vulnerabilities
End-of-life EasyIO FG controllers have hard-coded-credential and privilege-management weaknesses with no firmware patch planned. Restrict network and physical access, preserve configuration, and coordinate supported replacement with building operations rather than attempting an unavailable upgrade.
Tenable Nessus 10.12.5 Fixes Nine Vulnerabilities
Nessus 10.12.5 fixes nine vulnerabilities requiring authenticated users or privileged attackers. Update the scanner application, preserve configuration and scan history, and coordinate running jobs; current scan plugins alone do not establish fixed scanner software.