Product Security

ENISA has simplified where manufacturers report. It has not simplified the evidence needed to decide what must be reported.

AR2026-006 shows that affected ESP32 SoCs can accept invalid ECDSA signatures in ROM-based Secure Boot. Exploitation still requires the attacker to replace the signed image in flash, making storage access and manufacturing configuration part of the real assurance argument.

NIST IR 8536 provides an industry-neutral manufacturing traceability meta-framework built around interoperable records, cryptographic linkage and selective disclosure. For automotive and industrial supply chains, the assurance question is whether provenance evidence can still be verified across suppliers, configurations and deployed products.

Semiconductor security is moving toward formal sign-off. The useful gate is not another certification label, but traceable evidence that security requirements, verification coverage and residual risk survive the hardware, firmware and system boundary.

CVE-2026-64887 in Johnson Controls Airwall is a local hardcoded-key vulnerability. The broader engineering lesson is that embedded cryptographic secrets become lifecycle dependencies once products are deployed at scale.

Signed AAOS firmware can remain authentic while carrying exploitable dependencies, turning vulnerability remediation into a lifecycle and supply-chain governance problem.

VEX can suppress false urgency, but an unsupported “not affected” status simply converts vulnerability noise into governance risk.

OpenPLC research demonstrates malicious modification of the running user program. Compromise of source, repositories or build infrastructure is a separate engineering risk that requires its own evidence.

The Kia research showed how a public identifier and an over-privileged dealer workflow could become an internet-to-vehicle control path.

When regulatory evidence depends on sensors, ECUs, onboard monitoring and off-board data, integrity has to survive the complete chain.

A 24-hour early warning is manageable only when product identity, exploitability evidence and decision authority already exist before the incident.

Dealer-installed security hardware can cross the vehicle trust boundary without being governed like an OEM security component.

A patch can restore a PLM platform. It cannot by itself prove that the engineering artefacts and release decisions that passed through it remained trustworthy.

Detection only becomes a product-security capability when an alert can be translated into affected scope, trusted evidence, owned containment and a defensible residual-risk decision.