smartcitiesmission.com
Title card: Brotli Vulnerability Shows Why BMS Owners Need a Parts List, Building Cyber Security, smartcitiesmission.com
Cyber Security

Brotli Vulnerability Shows Why BMS Owners Need a Parts List

Smart City Bot

A memory bug in Google’s Brotli compression code, fixed in October and now on CISA’s exploited list, has turned up inside Siemens’ Desigo CC building management platform and a GE Vernova substation controller, and building owners learn this only when each vendor checks its own software and says so

This post argues that the Brotli vulnerability is less a patching story than a paperwork story: owners of building and city systems cannot find a flaw buried inside their vendor’s software on their own, so a parts list and a plain “affected or not” statement have to be written into the contract before the next flaw of this kind, not chased after it.

Two weeks after the fix went public, Siemens added a line to one of its security advisories. On 4 November, version 1.1 of SSA-045512 listed every version of Desigo CC V8 and V9, the company’s integrated building management platform, as affected by CVE-2026-111497, a flaw in Google’s Brotli decoder.[6] Two days later, version 1.2 added two pieces of Siemens grid software.[6] On 5 November GE Vernova published its own notice: the remote settings screen of its Multi-function Controller Platform, which includes the G500 and G100 substation devices, carries the vulnerable decoder.[8] None of these companies wrote the faulty code. It came in with an open-source library they had built into their products.

The Brotli fix is reaching building systems one vendor at a time, weeks apart

Brotli is a compression format Google created to shrink web pages and other traffic, rather like a zip file shrinks documents.[4] The decoder is the part that unpacks the data. Versions 1.0.3 to 1.2.0 contain what engineers call an out-of-bounds write: a deliberately malformed compressed stream can make the decoder write past the end of the memory it was given. The result can be a crash, leaked memory or, in the worst case, the attacker’s own code running on the machine.[1][6] Node.js, the popular server software, shipped fixes on 21 October,[2] and CERT-In issued a critical advisory, CIAD-2026-0055, on 27 October, naming Node.js, Bun, .NET, Envoy, Istio, the Python Brotli packages, cdxgen and PHP among the affected software.[1]

The history of the fix is odd. The change that closes the hole entered Brotli’s source code on 27 February, but no Brotli release carried it until 21 October, because nobody had realised it fixed a security bug.[3] And since each program carries its own copy of the decoder, each one has to be updated separately.[3] Researchers at JFrog later found routes into FFmpeg, ClickHouse and Apache Arrow, some of which begin with a file rather than a web request.[3] Cisco widened its own investigation to Brotli beyond Node.js on 30 October, and its advisory was still revising its lists of affected products and products under investigation on 10 November.[9]

The flaw has also collected nicknames along the way. Node2Shell, HTTP2Shell and Broccoli2Shell all refer to the same CVE,[8] and Johnson Controls filed its general guidance under the HTTP2Shell label on 30 October.[7] That sounds trivial until a maintenance contractor searches its records for one name while the vendor notice uses another. The CVE number is the only reliable handle.

Being on CISA’s exploited list does not make every BMS server an open door

How serious is it? That depends on who is scoring. Google, which assigned the CVE, rates it 9.2 out of 10, while Red Hat and Microsoft put it at 8.1.[3] Siemens lists 9.8 on the older CVSS 3.1 scale.[6] As late as 23 October, CISA’s assessment recorded no known exploitation, and Red Hat said there was no reliable public proof that code could be run.[3] Then, on 27 October, CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 10 November for US federal agencies.[5]

The real exposure is narrower than the headlines suggest. Red Hat says environments where no application decompresses Brotli data from untrusted sources are not affected in practice.[10] For .NET, Microsoft’s position, as reported by The Hacker News, is that an application is exposed only if it switches on Brotli in request or response decompression, neither of which is on by default, or passes untrusted data to Brotli functions.[3] For Desigo CC, Siemens’s remedy is simply to install the latest .NET security updates through Windows Update.[6]

That sounds easy, and on an office laptop it is. A BMS server is a different animal. In many buildings it sits on its own network, runs software validated against a particular Windows setup, and is looked after by an integrator who visits a few times a year. Siemens itself recommends validating any security update before it is applied, with trained staff supervising.[6] So the real question for an owner is not whether a patch exists but who will install it on the server, when, and how anyone will know it was done. We made the same point about three other advisories in Who Patches Cameras and BMS?

Siemens also told customers which products are safe, and that list saves as much time as the affected one

Read further down SSA-045512 and there is a second list, of products known not to be affected: Heliox and SICHARGE chargers, the VersiCharge AC series, Sifinity and VersiCloud, each marked “Node.js not present (Component Not Present)”.[6] That list is worth a great deal. A facility manager running those EV chargers in a basement car park can stop worrying and move on.

This is precisely the kind of statement CERT-In’s Technical Guidelines on SBOM ask suppliers to produce. A software bill of materials, or SBOM, is a parts list for a piece of software: every library inside it, with its version.[11] The guidelines describe a companion document called VEX, short for Vulnerability Exploitability eXchange, in which a supplier tells customers whether a product is not affected, affected, fixed or still under investigation for a particular flaw.[11] CERT-In recommends that government, public sector and essential services organisations include SBOM requirements in all software and solution purchases, and that their security teams feed the SBOM inventory into vulnerability management.[11] Its Cyber Security Guidelines for Smart City Infrastructure carry the same message, encouraging smart city departments to make SBOMs a mandatory part of software procurement.[12]

Without a parts list, all an owner can do is wait. CERT-In’s advisory, quite reasonably, names software runtimes rather than BMS brands.[1] The Desigo CC entry arrived 14 days after Node.js published its fix,[2][6] and GE Vernova’s notice came 15 days after.[8] For a flaw that had already reached CISA’s exploited list, that is a long time to be guessing.

Three requests to send your BMS and command centre vendors this week

Start by asking each vendor of a building management, access control, video or command centre platform for a written statement on CVE-2026-111497 for the exact versions you run: affected, not affected, fixed, or still being checked. Quote the CVE number, not a nickname. On Desigo CC sites, ask the integrator to confirm that the .NET updates Siemens specifies are installed on every server and workstation, and to note the date.[6]

While you wait, close the doors you can. The Canadian Centre for Cyber Security advises dealing first with internet-facing systems that use the vulnerable component, stopping affected applications from processing Brotli content from untrusted sources where an update is not yet possible, and watching for unexpected crashes.[4] GE Vernova’s interim step for its controllers is to block the remote settings port, 8081, and configure the device locally until fixed firmware arrives.[8] As we argued in our piece on the SSHole OpenSSH flaw, the boxes that face the internet deserve attention first.

Then fix the contract for next time. Picture a hypothetical tender for a new hospital BMS that requires an SBOM at handover, refreshed with every software release, and a VEX-style reply within an agreed number of days of any critical CVE. The next Brotli would become a lookup in a file rather than a fortnight of emails. Our guide to turning CERT-In’s OEM guidelines into contract clauses shows how such recommendations can be written into an agreement.

Brotli will not be the last flaw of this kind. Open-source libraries sit inside nearly every modern building and city platform, and the owners who can read their vendors’ parts lists will answer the next one in hours, not weeks.

Planning a command and control centre? Talk to Trisim Global Solutions.

Trisim Global Solutions control room solutions

Trisim’s view: a building system you cannot itemise is one you cannot patch, so the software parts list belongs in the handover file next to the as-built drawings.

Sources

  1. CERT-In, CERT-In Advisory CIAD-2026-0055: Out-of-Bounds Write Vulnerability in Google Brotli Decoder, 27 October 2026
  2. Node.js Project, Wednesday, October 21, 2026 Security Releases, 21 October 2026
  3. The Hacker News, Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software, 24 October 2026, updated 26 October 2026
  4. Canadian Centre for Cyber Security, AL26-027: Critical vulnerability impacting Google Brotli, CVE-2026-111497, 28 October 2026
  5. CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-111497 added 27 October 2026), accessed 11 November 2026
  6. Siemens ProductCERT, SSA-045512: Node2Shell Vulnerability in Siemens Products, 30 October 2026, updated 6 November 2026
  7. Johnson Controls, Security Advisories (HTTP2Shell JCI-PSA-2026-31 v2), 30 October 2026
  8. GE Vernova, Security Advisory GES-2026-015: Buffer overflow vulnerability, Multi-function Controller Platform (PDF), 5 November 2026
  9. Cisco, Vulnerabilities in Node.js and Brotli Affecting Cisco Products, 27 October 2026, updated 10 November 2026
  10. Red Hat, RHSB-2026-015 Out-of-Bounds Write: Google Brotli Decoder (CVE-2026-111497), 26 October 2026, updated 27 October 2026
  11. CERT-In, Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, Version 2.0 (PDF), 9 July 2025
  12. CERT-In, Cyber Security Guidelines for Smart City Infrastructure (PDF), undated, accessed 11 November 2026

Leave a Reply