Vulnerability / research

Cipher reports AI-assisted discovery of four EPICS memory-safety flaws

Reported

Published here

What happened

Causal Security says Cipher found and reproduced four network-reachable EPICS Base flaws in an isolated environment. Tests demonstrated memory corruption and crashes in scientific control-system protocols.

Parties and reporting

AI tools and systems: Cipher autonomous security system, EPICS Base Channel Access, Classic pvAccess

Outcome

EPICS Base 7.0.11 contains fixes. The most severe flaw demonstrated an attacker-influenced buffer write; remote code execution was a potential consequence, not a demonstrated result.

Operating lesson

Inventory embedded control-system components, test supported patches against legacy clients, and restrict protocol access while preserving operational safety.

Evidence and limits

The earliest reviewed public flaw disclosure is EPICS PR934 on July 19; pvDataCPP PR109 followed July 27. October 27 dates the grouped AI-research report and 7.0.11 release. The claimed 3-hour-49-minute discovery is provider-reported, with one human authorization for deeper sandbox tests. No production compromise is established; these general EPICS CVEs remain outside the AI-product register.

Sources