Industrial Threat Overview
GE Vernova, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), has issued a critical advisory detailing a maximum-severity flaw (CVE-2026-79220, CVSS 9.6) impacting its Mark VIe and safety-instrumented Mark VIeS Distributed Control Systems (DCS). Mark VIe controllers form the operational backbone of global energy generation, regulating heavy-duty gas turbines, steam turbines, and hydro generators across hundreds of gigawatts of worldwide electric grid capacity.
The flaw enables an unauthenticated attacker positioned on the plant control network (Purdue Level 2) to broadcast malformed Ethernet Global Data (EGD) packets, overriding real-time turbine operational variables, disabling fuel control loops, or forcing an emergency mechanical overspeed trip that disconnects the generator from the electric grid.
Protocol Root Cause: EGD Exchange ID Validation Failure (CWE-287 / CWE-345)
The Mark VIe controller coordinates real-time data sharing across redundant triple-modular controllers (designated R, S, and T) and remote I/O packs using the Ethernet Global Data (EGD) protocol over UDP port 18246. EGD exchanges operate on a producer-consumer model where producers broadcast periodic data packets identified by an Exchange ID and Request ID.
Investigators discovered that the controller's EGD communication stack failed to enforce cryptographic authentication or monotonic sequence counter validation on incoming command exchanges. An attacker capable of injecting UDP datagrams into the plant control network can forge EGD packets purporting to originate from the primary Human-Machine Interface (WorkstationST), overwriting the turbine speed setpoint register:
| Affected Controller Hardware | Vulnerable Firmware | Remediated Firmware Release |
|---|---|---|
| Mark VIe UCSA / UCSB / UCSC | ControlST prior to V07.08.00 | Upgrade to ControlST V07.08.00 or apply patch |
| Mark VIeS Safety Controller | ControlST Safety prior to V07.06.02 | Upgrade to V07.06.02 or apply security hotfix |
Operational Impact: Grid Frequency Instability & Equipment Stress
Turbine trips at utility-scale combined-cycle power plants (500MW+ per train) cause sudden multi-gigawatt power loss on high-voltage transmission grids, risking localized blackouts and grid frequency collapse. Repeated rapid thermal shutdowns also subject gas turbine blades and combustor cans to extreme mechanical thermal shock, requiring costly emergency inspections.
IEC 62443 Defense-in-Depth Remediation Directives
Power generation operators and balance-of-plant engineers must execute the following remediation measures in accordance with IEC 62443-3-3 System Security Requirements:
- Apply Firmware Patch: Upgrade in-scope Mark VIe controllers to ControlST V07.08.00 during scheduled unit outage windows.
- Isolate EGD UDP Port: Block UDP port 18246 at all plant network boundary switches, ensuring EGD traffic cannot route beyond the dedicated turbine control VLAN (Purdue Level 2/Level 1).
- Enforce Unidirectional Gateways: Deploy hardware data diodes for all operational data historians extracting turbine metrics to corporate Level 4 enterprise networks, eliminating all reverse network paths.
