1. Executive summary
HMS Networks has fixed six vulnerabilities in its PEAK-System PCAN Windows CAN device drivers and the associated Device Driver Setup package, affecting versions up to and including 5.1.2 (drivers) and 5.1.2.1151 (setup). The flaws are kernel-mode memory-safety and logic defects that a local caller can reach through the driver's file-device write path; CISA states successful exploitation could crash the Windows kernel. No CVSS score, CWE mapping, EPSS estimate or CISA KEV entry has been published for any of the six CVEs, and CISA reports no known public exploitation and no remote exploitability. The exposure for EMEA financial services is narrow: these drivers sit on engineering and test workstations that connect to CAN bus hardware, not on core banking or payment infrastructure, so the practical risk is a local denial of service or privilege boundary issue on a small number of specialist hosts rather than a route to customer data or payment flows.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
CISA lists six CVEs against both affected products: CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322 and CVE-2026-105960. The advisory does not map individual CVE identifiers to individual defect descriptions, so the five mechanisms below cannot be tied to a specific CVE from the source. No CVSS vector, CWE classification or severity rating is given for any of them.
The confirmed attack path, as far as the source supports it:
- An attacker gains the ability to issue I/O to the PCAN driver's file device from a local context on a Windows host with the driver loaded.
- The attacker supplies a crafted CAN receive record, or a crafted request, through that write path.
- The driver processes the record without adequate bounds or pointer validation and writes past a fixed-size destination or dereferences an unvalidated pointer.
- The result is memory corruption in kernel mode, which CISA describes as capable of crashing the Windows kernel.
The five defect mechanisms described:
- Parser record-list accounting. The parser correctly detects a malformed record, but the loop that iterates the record list advances its processed-bytes counter even when a record has been rejected as invalid. This is a logic error in length accounting rather than a direct overwrite.
- DLC-indexed length table. The parser indexes a length table using an attacker-controlled DLC value without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. This is a stack buffer overflow driven by an out-of-range CAN data-length code.
- Type 0x4030 post-processing. The type 0x4030 processing path fails to validate a selected or returned object pointer before dereferencing fixed fields during post-processing. This is a pointer-validation failure.
- Variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. A caller can combine a small output allocation with controlled source bytes, and the copied source field is attacker-influenced through the file-device write path.
- The fifth described path is the receive-record copy above; the source does not describe a sixth distinct mechanism, so one of the six CVEs is not individually characterised in the advisory text.
CISA states the vulnerabilities are not exploitable remotely and that no known public exploitation specifically targeting them has been reported. The advisory does not describe privilege escalation to a higher integrity level, persistence, command-and-control, lateral movement or data exfiltration, and none should be inferred. The stated impact ceiling is a kernel crash. Whether any of these defects is reachable for reliable local privilege escalation from a low-privilege process is not established in the source and would require reverse engineering of the fixed driver.
The affected products are deployed worldwide across the Transportation Systems, Healthcare and Public Health, Energy, and Critical Manufacturing sectors. HMS Networks is headquartered in Sweden. Seyeon Bang reported the vulnerabilities to CISA. No threat actor is named and no exploitation campaign is described.
4. Mitigation & containment
P1 within 24 hours
- Inventory every Windows host carrying the PEAK-System PCAN driver. Check installed driver version against 5.1.2 and the Device Driver Setup package against 5.1.2.1151; anything at or below those versions is affected. Use the installed-program list for "PEAK-System Device Driver Setup" and the driver store for the PCAN driver package.
- Upgrade to HMS Networks version 5.1.4, available from the PEAK-System software download page referenced in the CISA advisory. Reboot after installation so the kernel driver is replaced in memory.
- On hosts that cannot be patched immediately, restrict local write access to the PCAN driver's file device to the accounts and applications that genuinely need CAN access. The source identifies the file-device write path as the reachable surface.
P2 within 72 hours
- Confirm the driver is not exposed to untrusted local users on shared engineering or test workstations. Where a workstation is multi-user, move CAN hardware and the PCAN driver to a dedicated host.
- Apply CISA's recommended practice of keeping control-system hosts off the internet and segmented behind firewalls from business networks. This does not remediate the local flaws but limits who can reach the host to trigger them.
P3 within 7 days
- Add driver-version checks for PEAK-System PCAN to the standard build and asset baseline so future versions are tracked.
- Review whether any application that passes externally sourced data into the PCAN driver (for example a CAN log replay or protocol-conversion tool) can be fed untrusted input, and sandbox or restrict it.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory describes defect mechanisms, not observed malicious artefacts, and names no hashes, filenames, paths, registry keys or network indicators.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- CISA, "HMS Networks PEAK-System PCAN Windows drivers" (ICSA-26-293-01), published 2026-10-20. https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
8. Adverse Trace position
No CVSS score, severity rating or CISA KEV status has been published for any of the six CVEs, so we do not assign one; the source's own impact statement is a potential Windows kernel crash from a local caller, with no remote exploitability and no known public exploitation. For EMEA financial services clients the affected population is specialist engineering and test workstations with CAN hardware attached, and the realistic impact is local denial of service or a local privilege boundary issue on those hosts, not a path to payment systems or customer data. We will monitor for a vendor security advisory from HMS Networks that maps the six CVE identifiers to individual defects and for any CVSS or KEV assignment, and we will reissue this note if either appears. Clients should treat the 5.1.4 upgrade as a routine engineering-workstation patch task rather than an incident response action.
Published via PulseTrace — Adverse Trace threat intelligence.