A Routine Pen Test Found a Zero-Day. The Vendor Response Was the Real Lesson. (opens in new tab)

This was supposed to be a routine external penetration test. Within minutes, it was not. A colleague on our pen test team was running asset discovery when he flagged an internet-facing HMI tied to industrial control systems. At first, it looked like one more exposed web interface on a non-standard…