Research
Findings and reports, with the record behind them.
Each row is a dated finding or report, with a status a reader can hold the practice to.
Advisories
| Reported | Class | Affected | Severity | Status |
|---|---|---|---|---|
| Out-of-bounds read, CWE-125 | A telecontrol protocol library | Low | Reported to the maintainer, fix pending, CVE requested |
- 2026-09-03Discovered
- 2026-09-07Reported
- PendingFix released
- After the patchPublished
Severity is low. The fault is a one-to-two-byte over-read that lands inside a fixed buffer on real hardware. The worst case is an incorrect acknowledgement or a brief desync of the link. Triage reduced several hundred saved crash files to this one unique fault before the root cause was written up. The full writeup follows once the maintainer has shipped the fix.
Reports
- 2026-09Attacking and defending an EtherNet/IP water controllerThree attack classes: deceive with false data injection, seize with a lockout, destroy with a denial of service. Each is paired with ATT&CK for ICS and IEC 62443 and with the detections that catch it.Read
How findings are handled
- iEvery finding is reproduced before it is written up.A crash becomes a finding once it is reduced to a minimal input and confirmed against the current release under a sanitiser.
- iiThe maintainer hears first, with a fix attached.The report carries the root cause and the patch, with a proof of concept the maintainer can run the same day.
- iiiPublication follows the patch.A finding stays private until the fix has shipped and the maintainer has had time to release it.
- ivThe tooling is open source.The fuzzing suite is public under Apache-2.0, so a result can be re-run by anyone who reads it.