Executive Summary

Industrial cybersecurity teams at GE Vernova, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), have published a critical advisory warning of a high-severity vulnerability affecting Mark VIe and Mark VIeS distributed control systems (DCS). Tracked under CVE-2026-57812, the vulnerability carries a CVSS v3.1 base score of 8.6 (High) and impacts heavy-duty gas turbine, steam turbine, and wind generation controllers worldwide.

The Mark VIe platform is a cornerstone of global power generation, managing megawatts of electrical generation across utility-scale power plants. Successful exploitation allows an attacker situated on the plant supervisory network to trigger a permanent communication loss across redundant controller racks, forcing generating units into emergency shutdown trips.

Root Cause Analysis: Ethernet Descriptor Exhaustion in UDH Driver

Communication between Mark VIe controllers (such as the UCSB and UCSD processor modules) and human-machine interface (HMI) servers occurs across the proprietary Unit Data Highway (UDH) using Ethernet global data (EGD) and Modbus protocols. When processing high-frequency broadcast or multicast packets with corrupted checksum lengths, the controller's onboard network coprocessor driver fails to release transmit/receive buffer descriptors.

When an attacker transmits a sustained stream of malformed UDP frames across port 18246 (EGD), the controller's network ring buffer becomes entirely exhausted within seconds. Because redundant controller synchronization (TMR - Triple Modular Redundancy) relies on deterministic inter-controller heartbeats, the loss of networking triggers an internal safety fault. The controller trips the master protective circuit, shutting down fuel control valves to the operating turbine.

Turbine Protection Trip Sequence:
1. Attacker broadcasts malformed EGD frames across Level 3 Unit Data Highway
2. UCSB Controller network buffer descriptors leak without recycling
3. Controller stops responding to Triple Modular Redundancy (TMR) heartbeat sync
4. Hardware Safety Watchdog asserts: Controller initiates emergency trip
5. Generating unit disconnects from high-voltage transmission grid

Grid Stability & Operational Consequences

In power utility operations conforming to NERC CIP and IEC 62443 standards, sudden turbine trips have severe consequences:

  • Immediate loss of 300MW to 800MW of generation capacity from a single combined-cycle block, threatening regional grid frequency stability.
  • Thermal stresses on multi-million-dollar turbine rotors and boiler components caused by emergency thermal shutdowns.
  • Hours of plant startup delays and millions of dollars in lost electricity dispatch revenue.

Remediation Playbook

GE Vernova has released updated firmware packages and instructs all power plant asset owners to execute the following mitigation protocol:

  1. Deploy ControlST Updates: Install ControlST v08.02 or apply Hotfix HF-57812 to update UCSB, UCSD, and UCSC processor firmware images.
  2. UDH Network Rate Limiting: Configure industrial managed switches on the Unit Data Highway to enforce strict broadcast and multicast storm control (limiting UDP traffic on port 18246 to authorized HMI MAC addresses).
  3. Isolate Level 3 from Corporate IT: Verify that no direct routing exists between enterprise corporate networks and the turbine control network in accordance with Purdue Model Level 3 boundaries.