OTPulse

HMS Networks PEAK-System PCAN Windows drivers

MonitorCVSS 7.1ICS-CERT ICSA-26-293-01Oct 20, 2026
HMS Networks
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

PEAK-System PCAN Windows device drivers contain buffer overflow vulnerabilities (CWE-787, CWE-120, CWE-129, CWE-822, CWE-130) that allow local users with standard privileges to cause denial of service by crashing the Windows kernel. Affected versions include PEAK-System Device Driver Setup up to 5.1.2.1151 and PCAN Windows CAN device drivers up to 5.1.2.

What this means
What could happen
An attacker with local access to a Windows workstation running PEAK-System PCAN drivers could crash the system kernel, causing loss of connectivity to attached CAN bus industrial devices and forcing a system restart to restore operations.
Who's at risk
Organizations operating CAN bus industrial devices connected through Windows workstations—including water utilities managing SCADA systems, electric utilities controlling distributed sensors, and manufacturing facilities with programmable controllers—that use PEAK-System PCAN device drivers for CAN interface connectivity.
How it could be exploited
An attacker with local user privileges on a Windows machine exploits a buffer overflow vulnerability in the PEAK-System PCAN driver through local interaction with the driver code, causing kernel memory corruption and system crash.
Prerequisites
  • Local access to Windows workstation with PEAK-System PCAN drivers installed
  • User-level (non-admin) privileges on the affected Windows system
  • Ability to interact with the PCAN driver through device interface or application
Local access requiredLow complexityBuffer overflow vulnerabilityKernel-level impact (system crash)No authentication required
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 pending
ProductAffected VersionsFix Status
PEAK-System Device Driver Setup≤ 5.1.2.1151No fix yet
PCAN Windows CAN device drivers≤ 5.1.2No fix yet
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate PEAK-System PCAN Windows drivers to version 5.1.4 or later
Long-term hardening
0/2
HARDENINGRestrict local access to workstations running PCAN drivers to trusted users only
HARDENINGEnsure PCAN-connected workstations do not run untrusted applications from unprivileged users
View full CISA ICS-CERT advisory
API: /api/v1/advisories/7906c9a3-e082-4446-9979-ee7d4830d961

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

HMS Networks PEAK-System PCAN Windows drivers | CVSS 7.1 - OTPulse