We’re Tracking the Future of Security

Category: Energy

  • ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB has addressed two vulnerabilities in PCM600, its protection and control engineering tool. CISA says the flaws could let a local attacker elevate privileges or cause project-archive files to be written outside the intended extraction directory.

    Two different local attack paths

    CVE-2026-15952 concerns permissions around a scheduler component running as LocalSystem. Under the conditions described by the advisory, a local user could exploit that arrangement to gain higher privileges. CVE-2026-15953 is a path-traversal issue in project archive handling that could place files beyond the selected extraction folder.

    CISA lists PCM600 versions through 2.14 as affected and gives the vulnerabilities a maximum CVSS v3 base score of 6.4. The agency says it is not aware of public exploitation. ABB has published product security advisories and provides workaround guidance for affected deployments.

    Why engineering workstations need special care

    PCM600 is used in energy-sector protection and control engineering. An engineering workstation can therefore hold trusted project files and privileged access to operational assets even when it is not directly exposed to the internet. Organizations should apply ABB’s guidance, limit local administrator rights and treat imported project archives as untrusted until validated.

    Before remediation, teams should back up projects and confirm recovery procedures. Afterward, review scheduled tasks, extraction directories and endpoint telemetry for unexpected files or privilege changes. SectechMedia’s energy-security coverage examines the wider operational context for protecting utility and industrial environments.

    Sources

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • CISA Advisory Flags Two Critical Flaws in Hitachi Energy Grid Control Platform

    CISA Advisory Flags Two Critical Flaws in Hitachi Energy Grid Control Platform

    CISA published an advisory covering five vulnerabilities in Hitachi Energy’s FACTS Control Platform (FCP), software used to manage Flexible AC Transmission Systems that stabilize voltage and power flow on electric grids. Two of the flaws, CVE-2024-4872 and CVE-2024-3980, are rated 9.9 (Critical) on the CVSS v3.1 scale; a third, CVE-2024-7940, is rated 8.3 (High); a fourth, CVE-2024-3982, is rated 8.2 (High); and a fifth, CVE-2024-7941, is rated 4.3 (Medium).

    According to CISA, the flaws include improper neutralization of special elements in data query logic, path traversal, authentication bypass by capture-replay, missing authentication for a critical function, and open redirect. An authenticated attacker could chain these to inject code, access critical files, hijack sessions, bypass authentication or run phishing attacks against operators. Hitachi Energy says only FCP deployments with the GWS component installed since 2020 are affected, spanning FCP versions 3.4.0 through 4.1.1. The company’s advisory 8DBD000229 outlines remediation; interim mitigations include isolating control systems behind firewalls, requiring VPNs for remote access and enforcing strong password policies.

    Why it matters

    FACTS platforms sit inside the control layer that keeps transmission voltage stable — CISA lists the affected sector as Energy, and a successful chained exploit could let an authenticated attacker manipulate grid-stabilization logic rather than simply steal data.

    Sources

  • FERC Approves Tougher NERC Physical Security Standard for Critical Power Substations

    FERC Approves Tougher NERC Physical Security Standard for Critical Power Substations

    The Federal Energy Regulatory Commission has approved a revised reliability standard, CIP-014-4, developed by the North American Electric Reliability Corporation to strengthen physical security requirements for critical bulk-power transmission substations and control centers. The standard applies to facilities whose loss or damage could trigger cascading failures across the grid, and the revision tightens the timelines utilities must follow when conducting risk assessments of those facilities.

    The order also clarifies which facilities fall under the standard’s scope and increases the rigor required for third-party verification of risk and vulnerability evaluations. FERC simultaneously approved retirement of the prior standard, CIP-014-3, with utilities given a multi-year runway to reach compliance with the new requirements.

    Why it matters

    Physical attacks on substations — from gunfire to intrusion — have repeatedly knocked out power to thousands of customers in recent years; a tighter, more consistently enforced risk-assessment standard is meant to close gaps in which facilities utilities have historically been required to protect.

    Sources

  • Coast Guard and FBI Board Oil Tankers After Cyberattacks Reach Engine-Room Systems

    Coast Guard and FBI Board Oil Tankers After Cyberattacks Reach Engine-Room Systems

    The US Coast Guard and FBI boarded at least two foreign-flagged, US-bound oil tankers in the Gulf of Mexico — including the Liberian-flagged VL Prosperity — on August 21 and August 24, 2026, after detecting evidence that the vessels’ onboard networks had been compromised. Coast Guard Rear Adm. Amy Grable confirmed “evidence of a malicious cyber actor” on the ship’s IT/OT systems, though the Coast Guard has not attributed the intrusion to any state actor. A joint team of Coast Guard cyber specialists, a vessel inspector and an FBI Cyber Action Team spent four days aboard the VL Prosperity.

    Iran’s Mehr News Agency separately reported that the VL Prosperity suffered a cyberattack on August 7 while transiting the Strait of Gibraltar, alleging the intrusion reached engine-room systems — altering coolant flow, engine speed and fuel delivery — and knocked out communications for roughly 30 hours; those specific technical claims have not been confirmed by the Coast Guard. Officials say there is no evidence the vessels operated unsafely, and the Coast Guard says it has conducted an estimated 40-50 similar cyber-related boardings over the past year.

    Why it matters

    Commercial vessels increasingly run networked engine, navigation and fuel-management systems that were not designed with the same threat model as IT networks — an attacker reaching those systems mid-voyage, even briefly, raises the kind of physical-safety stakes that a typical office network breach does not.

    Sources

  • Airwise and UAS Sentry Integrate Remote ID Drone Detection Into Airspace Platform

    Airwise and UAS Sentry Integrate Remote ID Drone Detection Into Airspace Platform

    Airwise Solutions and UAS Sentry announced a partnership integrating UAS Sentry’s Nexus Remote ID drone-detection capability into Airwise’s Nexus operational airspace platform. The integration displays detected Remote ID signals from nearby drones alongside an organization’s own drone operations, airspace data, mission activity, telemetry, FAA services and weather in a single operating picture.

    The companies are targeting critical infrastructure operators, utilities, energy sites, public-safety agencies, airports and industrial facilities that need visibility into unauthorized drone activity in their airspace — not just their own fleet’s operations.

    Why it matters

    Remote ID data gives facility operators a legal, standards-based way to see who is flying a drone nearby without deploying their own detection hardware, which lowers the barrier to basic airspace awareness for sites that can’t justify a full counter-UAS system.

    Sources

  • Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    CISA published an advisory disclosing 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays, devices used in electrical substations worldwide to detect faults and trigger circuit breakers. The most severe, CVE-2026-62645, carries a CVSS score of 9.8 out of 10 and stems from the relay’s web interface exposing information that lets an attacker calculate current and past session IDs — enough to bypass authentication entirely without any privileges or user interaction.

    The advisory also describes a related flaw allowing predictable session-ID generation from insufficient entropy, an out-of-bounds write reachable through crafted URLs that can force the device to reboot, and a physical-access vector that could allow unsigned code execution through a maintenance-mode key sequence. Siemens has released firmware version 2.70 to address the vulnerabilities; earlier versions remain exposed.

    Why it matters

    Protection relays are a core safety component of the electrical grid — an attacker who can bypass authentication on one gains the ability to interfere with fault detection and circuit-breaker operation, which is exactly the kind of access that grid-security planners worry about most.

    Sources

  • CISA Flags Critical Authentication Flaw in mySCADA myPRO Manager Used in Water, Energy Systems

    CISA Flags Critical Authentication Flaw in mySCADA myPRO Manager Used in Water, Energy Systems

    CISA released an advisory on September 15 warning of two vulnerabilities in mySCADA myPRO Manager, industrial control software from Czechia-based mySCADA Technologies that is deployed worldwide across the critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors.

    The more severe flaw, CVE-2026-73807, carries a CVSS v3.1 score of 9.8, near the maximum critical rating. CISA said the myPRO Manager command application programming interface fails to properly enforce authentication for privileged functions, meaning an unauthenticated attacker with network access to the API could reach privileged management capabilities without credentials. A second flaw, CVE-2026-82567, allows an unauthenticated attacker to send arbitrary SMS messages through a GSM modem connected to the software’s notification gateway.

    mySCADA Technologies has addressed both issues in myPRO Manager version 2.2 and is notifying connected users of the update, according to the advisory. The vulnerabilities were reported to CISA by Shirshak Secnora OU. CISA said it has not observed public exploitation of the flaws to date but urged operators to minimize internet exposure of control system devices, isolate them behind firewalls, and use virtual private networks for any required remote access.

    Why it matters

    myPRO Manager sits inside operational technology environments spanning energy, water and transportation, where an unauthenticated privilege gap can translate directly into physical-process risk. Asset owners should apply version 2.2 and re-confirm remote-access paths rather than assume perimeter isolation is already in place.

    Sources

  • CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    Houston-based utility CenterPoint Energy has told regulators that an unauthorized third party obtained personal information relating to some customers through an external-facing system. The company opened an investigation after becoming aware of a claim that customer data had been obtained.

    In its filing with the U.S. Securities and Exchange Commission, CenterPoint said the incident had not affected delivery of electric or natural-gas services and that it did not expect a material effect on the company. The filing did not validate a hacker’s separate claim about the number of records involved.

    SecurityWeek reported that a threat actor had advertised an archive allegedly containing CenterPoint data. That claim remains unverified, so the confirmed facts are narrower: customer information was accessed, an investigation is underway, and operational utility delivery continued.

    Why it matters

    The separation between customer-facing systems and operational service delivery is important for critical infrastructure. A breach can create serious privacy and fraud exposure even when operational technology remains available, and incident reporting should keep those impacts distinct.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • EV Charging Infrastructure Security Technology

    EV Charging Infrastructure Security Technology

    Public electric-vehicle charging infrastructure has expanded rapidly enough that it now represents a meaningful category of unattended, grid-connected, payment-processing equipment sited in open public locations — a combination of characteristics that draws on utility security, payment-card security and public-space asset protection simultaneously, without fitting neatly into any single existing security category.

    Physical Protection of Unattended Outdoor Hardware

    Charging stations are typically installed in parking lots, along roadsides and in other publicly accessible outdoor locations with no on-site attendant, exposing the equipment to vandalism, cable theft and tampering. Bollards and vehicle barriers to prevent impact damage, tamper-evident enclosures, and cameras covering charging bays are common baseline protections, similar in concept to the equipment-protection measures used for other unattended public-facing utility assets such as ATMs.

    Cable Theft and Copper Value

    Charging cables contain copper conductors with resale value on the scrap-metal market, which has made cable theft a recurring operational problem for charging-network operators in some regions. Responses include cable-retention hardware, tamper alarms on the charging connector housing, and network-level monitoring that flags when a charger goes offline outside of a scheduled maintenance window, since a sudden fault can indicate cable theft or vandalism rather than an equipment failure.

    Payment and Network Cybersecurity

    Point-of-Sale and Payment Card Data

    Charging stations that accept payment cards directly are subject to the same payment-card data-security obligations as any other point-of-sale device, and card-skimmer tampering — long a concern at fuel pumps and ATMs — has emerged as an analogous risk at charging terminals with card readers.

    Grid and Network-Connected Control Systems

    Networked chargers communicate with backend management platforms to handle billing, load balancing and remote diagnostics, and in some deployments participate in demand-response programs that adjust charging rates based on grid conditions. This network connectivity extends the security perimeter from the physical charger to the operator’s backend systems and, in aggregate, to the electric grid itself, making network segmentation and secure remote-management protocols a core part of the security architecture rather than an afterthought.

    Siting and CPTED Considerations

    Because charging sessions can take anywhere from minutes to hours, drivers may be away from their vehicle or waiting in a relatively exposed location for an extended period, which has led site designers to apply Crime Prevention Through Environmental Design (CPTED) principles — adequate lighting, natural surveillance and visibility from adjacent buildings or roadways — when selecting charging-station locations, alongside the electrical and traffic-flow criteria that traditionally drive site selection.

    FAQ

    Why is cable theft a bigger issue for EV chargers than for most other outdoor equipment?

    Charging cables use heavy-gauge copper conductors that have direct resale value as scrap metal, giving them a theft incentive that most other outdoor public infrastructure components do not carry to the same degree.

    Are EV charging stations considered part of critical infrastructure?

    Individual charging stations are not typically classified as critical infrastructure on their own, but as charging networks scale and participate in grid demand-response programs, their aggregate cybersecurity posture increasingly intersects with broader electric-grid security concerns.

    Conclusion

    EV charging infrastructure security blends unattended-asset protection, payment security and grid-connected OT concerns into a single, still-maturing category. As charging networks continue to scale, the sector is converging on practices borrowed from ATM security, retail payment-card protection and utility cybersecurity rather than developing an entirely new discipline from scratch.