Specified in 2000, missing from too many products

The piece of the week, because here is something sitting in a shipped product that usually stays inside architecture discussions. CISA rates the XCharge C6 charging point at CVSS 9.8 (v3.1) and classifies the flaw as "Download of Code Without Integrity Check": "Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package." What actually happens inside the device is described by SaiFlow, whose researchers reported it (saiflow.com, "RCE by Design"): the only validation is an MD5 sum the sender supplies alongside the firmware, and a script inside the package then runs with root privileges. The obvious reflex is the wrong one. A stronger hash changes nothing, because the sender computes that too. What is missing is a key. And the same advisory carries a third flaw almost nobody quotes: a service reachable through the charging connector accepts a default administrative credential. Not remotely: that one needs the cable in your hand. XCharge says it has deployed the correction to all affected chargers.

The case where the path does not reach this control unit. More than 421,000 Tucson and Santa Cruz vehicles from model years 2025 and 2026: the front camera software shows increased sensitivity to objects ahead in certain driving scenarios, so the collision avoidance system engages prematurely. 376 reports between October 2024 and April 2026, four crashes in which the Hyundai was rear-ended by a closely following vehicle, and four alleged injuries. NHTSA filing 26V316 gives the remedy as "Remedy Type: Software", a file and nothing else, and the record carries "overTheAirUpdate: false", so the remedy is not delivered over the air. Every owner is to be notified from 17 July and to drive to a dealer, where a technician reflashes the camera. There are good reasons to keep a braking-relevant camera in a workshop: calibration, a work order and a functional check per vehicle, and the blast radius of a variant-matching error at fleet speed. Those reasons are simply not weighed at the recall. They are settled years earlier, in the architecture and in a sourcing contract.

The case where nobody knows which devices their own remote path reaches. On 30 July the FBI and the EPA issued a warning, and CISA published its own alert the same day. The targets were Rockwell Allen-Bradley controllers, the MicroLogix 1100 and 1400 series; the FBI notes explicitly that it has only observed this behaviour with those. The linked report also names Schneider Electric and Siemens devices; those belong to a separate advisory from April. It began over the weekend of 26 July in Minnesota, and utilities in at least seven states then reported incidents. The actors changed passwords and IP addresses, and operators lost monitoring and control of their own plants. One utility also reported modified PLC project files, noticed as ladder logic discrepancies across several sites (FBI announcement I-073026-PSA). That is the only unauthorised change to code on a device anywhere in this week, and it did not arrive over an update path. It arrived over an open port. Boil-water notices, manual operation, flooding, pressure loss. The sentence I wrote down is in CISA’s internet exposure guidance from August, where the agency counts more than a hundred internet-exposed systems across the water and wastewater sector: the attack surface includes "cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans". Build a remote path without knowing which modems are in the field, and you have not built a maintenance interface. You have a door that is on nobody’s list.

The piece that shows trust has an expiry date. Microsoft’s 2011 Secure Boot certificates run out this year: the KEK expired on 24 June, the UEFI CA on 27 June, and the Production PCA follows on 19 October. The KEK is the authority under which entries are written into a device’s allow and deny lists. Microsoft gives the reassurance first: devices without the 2023 certificates "will continue to start and operate normally, and standard Windows updates will continue to install". Then the sentence that matters: "However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities." That is the Windows chain, and an industrial Linux device hangs off a trust anchor fused into its SoC rather than off Microsoft’s CA. The principle transfers anyway, and it is uncomfortable: your trust anchor is itself something with a shelf life, renewing it is an update, and that update runs through your supplier’s firmware. Sell twenty years of service life and you have sold that upkeep with it, whether or not it is in the contract.

To close, the case where something was signed and it still did not help. RAUC, one of the common open-source updaters for embedded Linux, closed a gap in March: in the legacy "plain" bundle format, packages over 2 GiB overflowed a counter and the signature ended up covering only the first bytes of the payload. Anyone holding a legitimately signed bundle could alter the rest. CVSS 7.2 (v4.0), fixed in 1.15.2; the newer "verity" and "crypt" bundle formats were never affected. Put together with the first piece, this is the week’s question. One product signed nothing, the other signed the wrong bytes. "Are updates signed?" catches only the first of those.