As reported by CISA, a coordinated advisory (ICSA-26-293-01) has been published detailing six distinct vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers — software components deeply embedded in Controller Area Network (CAN) bus communications across critical infrastructure environments. The combined CVSS v3 score of 7.1 (High) underscores the severity, but the real risk profile is more nuanced than a single number suggests.
Vulnerability Overview
| Attribute | Detail |
|---|---|
| Advisory | ICSA-26-293-01 |
| Combined CVSS v3 | 7.1 (High) |
| Individual CVSS Range | 5.5 (Medium) and above |
| CVEs | CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, CVE-2026-105960 |
| Affected Products | PEAK-System Device Driver Setup ≤5.1.2.1151; PCAN Windows CAN Device Drivers ≤5.1.2 |
| Patched Version | 5.1.4 |
| Attack Vector | Local (AV:L), Low Complexity (AC:L), Low Privilege (PR:L) |
| Primary Impact | Windows kernel crash (Availability) |
| CWEs | CWE-787 (OOB Write), Buffer Overflow, Improper Array Index Validation, Untrusted Pointer Dereference, Length Parameter Inconsistency |
| Active Exploitation | Not confirmed in the wild at time of advisory |
Why This Matters Beyond the Advisory Text
PEAK-System PCAN interfaces are not generic IT software — they sit at the boundary between Windows-based engineering, diagnostic, or control workstations and physical CAN bus networks. CAN bus is the communication backbone of automotive systems, industrial automation, medical devices, and transportation infrastructure. A kernel crash on a workstation running these drivers doesn't just mean a blue screen; in operational contexts, it can interrupt diagnostic sessions, disrupt real-time monitoring, or take a human-machine interface offline at a critical moment.
The vulnerability classes are also worth scrutinizing. Five of the six flaws involve fundamental memory safety failures — out-of-bounds writes, unchecked buffer copies, and untrusted pointer dereferences. This pattern suggests the driver's input parsing routines lack systematic validation rather than suffering from a single isolated bug. Organizations should treat this as a signal that the driver's entire input-handling surface may require scrutiny, not just the six reported CVEs.
The CVSS vector string (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms these are local availability-only impacts — no data confidentiality or integrity compromise is indicated. However, in OT environments, availability loss IS a safety issue.
Who Is Most at Risk
- Transportation Systems: Automotive engineering teams using PCAN for ECU diagnostics, flash programming, or vehicle network analysis on Windows workstations
- Energy Sector: Power grid control rooms or substation automation where CAN bus interfaces are used for equipment communication
- Healthcare: Medical device engineering and manufacturing environments where CAN bus protocols are used in diagnostic equipment
- Critical Manufacturing: Production lines relying on CAN-based PLCs or sensor networks managed through Windows-based SCADA or HMI systems
Any deployment where a low-privileged user or service account can interact with the PCAN driver is exposed. The local attack vector means exploitation requires either direct access or a multi-stage attack chain, but the low attack complexity (AC:L) makes reliable exploitation straightforward once access is obtained.
Shield53 Recommendations
Immediate Actions
PCANBasic.dll, PCAN_USB.sys, or related driver binaries. Check both engineering workstations and any kiosk or HMI systems that may have PCAN tooling installed.Strategic Considerations
- Vendor security posture assessment: Five memory-safety vulnerabilities in a single driver release suggest insufficient fuzzing or secure coding practices. Factor this into vendor risk assessments for future procurement decisions.
- SBOM integration: Ensure your Software Bill of Materials captures third-party kernel drivers — these are frequently excluded from standard software inventories but represent significant attack surface.
- Consider driver blocklisting: If PCAN drivers are only needed on specific engineering workstations, use WDAC to block driver loading on systems where it is not required, reducing your overall exposure footprint.
While no active exploitation has been confirmed at the time of advisory, the availability of six well-documented CVEs with clear technical details creates a roadmap for threat actors. The window between disclosure and exploitation is shrinking — treat this as a 72-hour remediation window for critical infrastructure assets and a 7-day window for all other deployments.
