EPICS Base'dagi to'rtta zaiflik hujumchilarga zarrachalar tezlatkichlari, termoyadro tajribalari va boshqa yirik tadqiqot muassasalarida ishlatiladigan boshqaruv tizimlaridagi jarayonlarni ishdan chiqarishga imkon berishi mumkin. Bitta kamchilik potentsial ravishda kod bajarilishiga olib kelishi mumkin.
CISA seshanba kuni e'lon qilingan maslahatida muammolarni ochib berdi va ular EPICS Base 7.0.10 va undan oldingi versiyalarga ta'sir qilishini aytdi. Agentlik 7.0.11 versiyasiga yangilashni tavsiya qiladi.
Zaifliklar Causal Security tomonidan yaratilgan Cipher avtonom xavfsizlik tadqiqot tizimi tomonidan aniqlangan.
EPICS ilmiy muassasalar o'z boshqaruv tizimlarini qurish uchun tayanadigan ochiq manbali dasturiy vosita bo'lib, EPICS Base uning markaziy komponentidir. Causal ma'lumotiga ko'ra, ITER termoyadro reaktori boshqaruv tizimi EPICS asosida qurilgan va Argonne Milliy Laboratoriyasidagi Advanced Photon Source undan keng foydalanadi.
Xatolarning eng jiddiyi CVE-2026-114595 (CVSS balli 9.8) bo'lib, tarmoq so'rovlari qayta ishlanganda yuzaga kelishi mumkin bo'lgan butun son to'lib ketishi (integer overflow). CISA ma'lumotiga ko'ra, bu noto'g'ri o'lchamli xotira ajratilishiga olib kelishi mumkin va keyinchalik hujumchi tomonidan taqdim etilgan ma'lumotlarni qayta ishlash xotirani buzishi, DoS (xizmatdan voz kechish) keltirib chiqarishi yoki potentsial ravishda masofadan kod bajarilishini ta'minlashi mumkin.
CVE-2026-114596 (CVSS balli 8.2) dan foydalanish jarayonni beqaror qoldiradigan yoki DoS keltirib chiqaradigan chegaradan tashqari yozuv (out-of-bounds write) ga olib kelishi mumkin. CVE-2026-114597 (CVSS balli 7.5) ilovani ishdan chiqarishi va yaqin xotiradan ma'lumotlarni sizdirishi mumkin bo'lgan chegaradan tashqari o'qish (out-of-bounds read), CVE-2026-114598 (CVSS balli 7.5) esa noto'g'ri tarmoq ma'lumotlari bilan ishga tushirilishi mumkin bo'lgan tur aralashuvi (type confusion) muammosi bo'lib, DoS ga olib keladi.
To'rtta xato ham EPICS tarmoq aloqasi uchun ishlatadigan Channel Access va pvAccess protokollarini qayta ishlash bilan bog'liq. Causal Security hammuassisi Shubham Raj SecurityWeek nashriga hujum nimani talab qilishini tushuntirdi.
"To'rttasi ham autentifikatsiyasiz yoki foydalanuvchi o'zaro ta'sirisiz ishga tushirilishi mumkin. Hujumchiga zaif EPICS xizmatlariga tarmoq kirishi kerak, odatda TCP 5064 (Channel Access) yoki 5075 (pvAccess) portlari orqali. Bu ochiq xizmat yoki muassasaning ichki tarmog'iga kirish orqali bo'lishi mumkin", dedi u.
Hujumlar qimmat tajribalarni buzishi mumkin
Zaifliklarning potentsial operatsion oqibatlari haqida Raj shunday tushuntirdi: "Operatsion jihatdan bu potentsial ravishda zarracha nurlarining uzilishi, tajribalarning buzilishi, kuzatuv ma'lumotlarining yo'qolishi yoki muhim tadqiqot uskunalarining qimmatbaho o'chirilishi (masofadan kod bajarilishini suiiste'mol qilish orqali) degan ma'noni anglatishi mumkin."
Biroq kod bajarilishi haqiqatda amalga oshirilmagan. "Cipher AddressSanitizer yordamida hujumchi nazoratidagi chegaradan tashqari heap yozuvi va jarayon ishdan chiqishini namoyish etdi", dedi Raj. Ushbu yozuv tasdiqlangandan so'ng, u funksional RCE (masofadan kod bajarish) ekspluatatsiyasini davom ettirmadi.
Internetga ochiq EPICS o'rnatishlarining soni ham noma'lum. Raj qisqa Censys tekshiruvi ochiq portlar asosida potentsial nomzodlarni aniqlaganini, ammo hech biri EPICS sifatida tasdiqlanmaganini aytdi.
Kamchiliklardan ommaviy foydalanish CISA ga xabar qilinmagan.
Xatolar to'rt soatdan kamroq vaqtda topildi
Causal ma'lumotiga ko'ra, Cipher to'rtta zaiflikni aniqlash uchun taxminan 3 soat 49 daqiqa sarfladi. U EPICS haqida hech qanday bilimga ega emas edi va ilmiy boshqaruv tizimlari uchun mo'ljallangan hujum usullari berilmagan.
Birinchi tahlil bosqichida hech qanday inson yo'naltirmagan. Keyinchalik tizim xatolar ekspluatatsiya qilinishi mumkinligini chuqurroq tekshirish bo'yicha yagona ko'rsatma oldi.
Cipher kod tarixi tekshiruvi kamchiliklar taxminan 14,5 dan 31,5 yilgacha eski ekanligini ko'rsatadi. EPICS saqlovchilari 9-iyunda xabardor qilingan va tuzatishlar iyul va avgust oylarida birlashtirilgan.
Shu oy boshida Causal tadqiqoti Grid Protection Alliance'ning openPDC va openHistorian (elektr tarmog'i o'lchovlarini qayta ishlaydigan) hamda FreeRTOS-Plus-TCP o'rnatilgan tarmoq stekida ham ochiqlarga olib keldi.
Bog'liq: Dengiz Koalitsiyasi Kema va Port Tizimlari Uchun Bepul Zaiflik Ma'lumotlar Bazasini Ishga Tushirdi
Bog'liq: Sanoat Sotuvchilari PHP2Shell Zaifliklari Uchun Mahsulotlarini Tekshirmoqda
Bog'liq: Accenture, Dragos, SANS AQSh Kichik Kommunal Xizmatlarini Himoya Qilish Uchun 10 Million Dollarlik Tashabbusni Ishga Tushirdi
Four vulnerabilities in EPICS Base could allow attackers to crash processes in control systems used at particle accelerators, fusion experiments and other large research facilities. One flaw could potentially lead to code execution.
CISA disclosed the issues in an advisory published on Tuesday, saying they impact EPICS Base 7.0.10 and earlier. The agency recommends updating to version 7.0.11.
The vulnerabilities were discovered by Cipher, an autonomous security research system made by Causal Security.
EPICS is an open source software toolkit that scientific facilities rely on to build their control systems, and EPICS Base is its central component. According to Causal, ITER’s fusion reactor control system is based on EPICS, and the Advanced Photon Source at Argonne National Laboratory makes heavy use of it.
The most severe of the bugs is CVE-2026-114595 (CVSS score of 9.8), an integer overflow that can occur when network requests are processed. According to CISA, it can lead to a wrongly sized memory allocation, and processing attacker-supplied data afterwards could corrupt memory, trigger DoS, or possibly enable remote code execution.
Exploiting CVE-2026-114596 (CVSS score of 8.2) can cause an out-of-bounds write that leaves the process unstable or causes DoS. CVE-2026-114597 (CVSS score of 7.5) is an out-of-bounds read that could crash the application and leak data from nearby memory, while CVE-2026-114598 (CVSS score of 7.5) is a type confusion issue that can be triggered with malformed network data, leading to DoS.
All four bugs are tied to the handling of Channel Access and pvAccess, the protocols EPICS uses for network communication. Shubham Raj, co-founder of Causal Security, explained to SecurityWeek what an attack would require.
“All four can be triggered without authentication or user interaction. An attacker needs network access to the vulnerable EPICS services, typically on TCP 5064 (Channel Access) or 5075 (pvAccess). This could be through an exposed service or access to a facility’s internal network,” he said.
Attacks could disrupt costly experiments
Regarding the potential operational consequences of the vulnerabilities, Raj explained, “Operationally, this could potentially mean interrupted particle beams, disrupted experiments, lost monitoring data, or expensive shutdowns of critical research equipment (by abusing remote code execution).”
Code execution has not actually been achieved, though. “Cipher demonstrated the attacker-controlled out-of-bounds heap write and process crash using AddressSanitizer,” Raj said. After that write was confirmed, he did not pursue a functional RCE exploit.
The number of internet-facing EPICS deployments is also unknown. Raj said a brief Censys check identified potential candidates based on exposed ports, but none could be verified as EPICS.
No public exploitation of the flaws has been reported to CISA.
The bugs were found in under four hours
According to Causal, Cipher needed roughly 3 hours and 49 minutes to identify the four vulnerabilities. It started with no knowledge of EPICS and was not given attack techniques designed for scientific control systems.
No human directed the first phase of the analysis. Afterward, the system received a single instruction to look more closely at whether the bugs could be exploited.
Cipher’s review of the code history shows the flaws are between approximately 14.5 and 31.5 years old. EPICS maintainers were notified on June 9 and merged patches in July and August.
Earlier this month, Causal’s research also led to disclosures in Grid Protection Alliance’s openPDC and openHistorian, which process power grid measurements, and in the FreeRTOS-Plus-TCP embedded networking stack.
Related: Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related: Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Related: Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities