The company says its Cipher agent found the flaws in 3 hours and 49 minutes, with one human authorization for deeper testing in an isolated environment. The Register interviewed its cofounder and also reports CISA's warning.
Exploitation requires reaching vulnerable EPICS services on a control network. Risks include process crashes, memory disclosure and possible code execution, which Cipher did not demonstrate. Operators are advised to install 7.0.11 or backported fixes and restrict network access.