ICS vulnerabilities decline but unpatched bugs increase

Even though industrial control system vulnerabilities reported to the Cybersecurity and Infrastructure Security Agency declined from 681 during the first half of 2022 to 670 during the first half of 2023, the rate of unfixed ICS flaws rose from 13% to about 34% during the same period, according to The Hacker News. Most of the reported ICS flaws during the first six months of 2023 had a high-severity rating, while the critical manufacturing and energy industries were most impacted by the flaws, a SynSaber report revealed. Mitsubishi Electric and Hitachi Energy accounted for most of the discovered ICS bugs for the critical manufacturing and energy sectors, respectively. Use after free vulnerabilities accounted for most of the reported ICS bugs, followed by out-of-bounds read and improper input validation flaws. "Forever-Day vulnerabilities remain an issue six CISA Advisories identified for ICS vendor products that reached end of life with 'Critical' severity vulnerabilities have no update, patch, hardware/ software/ firmware updates, or known workarounds," said SynSaber.