Disclosures on north-echohttps://northecho.dev/disclosures/Recent content in Disclosures on north-echoHugoen-usMon, 13 Jul 2026 00:00:00 +0000OpENer GetAttributeList — Out-of-Bounds Read and Stack Response Overflowhttps://northecho.dev/disclosures/vu-838758-opener-getattributelist/Mon, 13 Jul 2026 00:00:00 +0000https://northecho.dev/disclosures/vu-838758-opener-getattributelist/An unauthenticated attacker can send a single crafted GetAttributeList request that reads past the request buffer and corrupts stack-based response assembly in OpENer, reaching a stack-disclosure primitive under ASAN.OpENer SetAttributeSingle — Truncated Write Accepted and Applied to Live Statehttps://northecho.dev/disclosures/vu-982645-opener-setattributesingle/Mon, 13 Jul 2026 00:00:00 +0000https://northecho.dev/disclosures/vu-982645-opener-setattributesingle/OpENer accepts SetAttributeSingle requests with zero- or partial-byte payloads, applies the truncated value to live device state, and reports success — an unauthenticated integrity bug that crash-oriented fuzzing can’t see.Breaking Down the Substation: Four Vulnerabilities in Siemens SICAM S8000 (SSA-229470)https://northecho.dev/disclosures/sicam-s8000-ssa-229470/Thu, 09 Jul 2026 00:00:00 +0000https://northecho.dev/disclosures/sicam-s8000-ssa-229470/Four coordinated-disclosure vulnerabilities in Siemens SICAM S8000 — RBAC bypass, a firmware signature bypass, insecure OPC UA defaults, and a debug-interface DoS — fixed in V26.20 and published as SSA-229470.