Our industrial catalogue carries 84 SCADA, HMI, historian and gateway products, harvested from vendor documentation because the product runs air-gapped and cannot look anything up at run time. Among that material are 116 vendor advisories, 111 of which carry a fixed version that parses.
An advisory only does something for a customer if we can also read the version of the software in front of us. Otherwise it is a document, not a control. So the honest question is: how many of those 116 bands can actually decide anything?
Fourteen. Across five products.
Why that is not a backlog
The first assumption was that this is a research gap, and the fix is more harvesting. We measured it product by product before starting, and it is not.
Of the 40 products whose advisories are currently stranded, exactly zero are unresearched. Thirty-five of them, covering 89 bands, carry a researched and cited negative: the vendor does not publish a version to an unauthenticated reader. The largest single block is EcoStruxure Geo SCADA Expert with eight advisories, and its entry says:
Not found. No vendor page reviewed documents a version string readable without authentication. Do not assume a banner exists on 5481.
That is the correct answer, and it is a settled question. Carrying those 89 bands as pending work would keep re-opening it, and re-opening a settled question is how a catalogue grows fabricated facts. Sooner or later somebody closes the gap by inventing the endpoint.
The four that are genuinely open, and what they need
Four products have a version-bearing path where the vendor never states whether it answers before authentication. Proficy Batch Execution is the type case. GE publishes an endpoint that returns the product name and version, and separately states that basic authentication is required for the API as a whole, without ever saying the version endpoint is exempt.
More reading will not close that. A real instance will. It is a lab task, not a research task, and calling it research would misallocate the work indefinitely.
The one that needed a different kind of module
One product discloses its version, and not over HTTP. ICONICS documents that a GENESIS FrameWorX server emits a discovery announcement on multicast every three minutes, carrying the version and hostname. Our version reader sends HTTP requests, so the read was outside its shape rather than missing from its catalogue.
That one we built. It is a listener: it joins the group and waits, and the plant sends us the packet. Nothing is transmitted to the node, which matters here more than usual, because the alternative ICONICS identification markers all cost a packet at a port the vendor says an invalid message can crash.
Two implementations of it were wrong before the third was right, and only a real socket found either. Joining with no interface specified lets the operating system pick one, and on the multi-homed engine box that is the ordinary plant deployment, the announcement arrives on the other network card. Opening one socket per interface is worse on Windows and silently so, because they all bind the same port and the last socket bound receives the traffic. One socket with a group membership added per interface is the shape that works.
Even then, the advisory bands stay closed. ICONICS documents what the announcement carries and never its format, so a number pulled out of the datagram must not be allowed to decide whether a customer's historian is reported vulnerable. Version-shaped strings are recorded as candidates beside the raw bytes, and the finding says so in words.
Why we publish the number
Fourteen live bands out of 116 is not a flattering figure, and the temptation is to report the 116 and let the reader assume. We would rather state the ceiling. A customer buying an industrial assessment is entitled to know which of the advisories in the box can reach their equipment and which cannot, because the second group is not a promise we are quietly failing to keep. It is a property of the products themselves, and the honest product statement is that they do not tell an unauthenticated reader their version.
Frequently asked questions
How many of Nexich's 116 ICS advisories can actually be applied?
Fourteen, across five products. The catalogue holds 116 vendor advisories for industrial software, and 111 carry a fixed version that parses, but an advisory only works if the version of the running software can also be read. Most of the 116 cannot currently gate a finding on a customer's equipment.
Why can't most ICS vendor advisories be applied to real equipment?
Not because of missing research. Of the 40 products whose advisories are stranded, none are unresearched. Thirty five of them, covering 89 bands, carry a documented negative: the vendor does not publish a version string to an unauthenticated reader, so there is nothing for the advisory to check against.
What does Nexich do when a vendor doesn't say if an endpoint needs authentication?
It treats the gap as a lab task, not a research task. Four products, Proficy Batch Execution among them, have a version bearing path where the vendor never states whether it answers before authentication. More reading will not resolve that; only testing against a real instance will.
How does Nexich read the version of an ICONICS GENESIS FrameWorX server?
By listening rather than asking. ICONICS documents that a GENESIS FrameWorX server broadcasts its version and hostname on multicast every three minutes. Nexich built a listener that joins that multicast group and waits for the announcement, because the other ICONICS identification methods each cost a packet at a port the vendor says an invalid message can crash.
Does Nexich trust the version number it reads from the ICONICS multicast broadcast?
No. ICONICS documents what the announcement carries but never its format, so a number extracted from the datagram cannot be trusted to decide whether a historian is vulnerable. Nexich records version shaped strings as candidates beside the raw bytes, and the finding says so in words rather than asserting a confirmed version.
Why does Nexich publish a number as low as 14 out of 116?
Because publishing only 116 lets a reader assume every advisory reaches their equipment. The figure of 14 is the honest ceiling: it tells a customer which advisories can currently decide something about their assets, and states plainly that the rest is a property of the products themselves, not a gap Nexich is quietly failing to close.