The ICS PROJECT (Intrusive Control Systems PROJECT) was created to actively identify vulnerabilities in systems (industrial & embedded) and contribute to their official recognition (CVE).
The work carried out goes beyond traditional client engagements and is part of a voluntary approach, with a clear objective: to produce exploitable vulnerabilities in controlled environments, qualify them, and have them publicly recognized. This approach makes it possible to act directly on the security of technologies used in industry by revealing real flaws and contributing to their remediation through responsible disclosure.
Beyond this contribution, the ICS PROJECT is a dedicated exploration space. It enables working on open-ended challenges, testing new approaches, and tackling high-impact technical topics. This dynamic, both individual and collective, fosters engagement, stimulates curiosity, and sustainably strengthens the team’s expertise.
Our objective is not limited to identifying vulnerabilities: we demonstrate that they are truly exploitable by producing concrete proof-of-concept exploits, up to their publication as CVEs.
The work carried out within the ICS PROJECT is based on exploring existing environments under conditions close to production. Each research effort is conducted within a controlled framework, in compliance with responsible disclosure principles.
Concretely, the approach is based on several key steps:
Detection of vulnerabilities in real systems
Development of proof-of-concept exploits (PoC)
Technical assessment and impact assessment
Clear and reproducible documentation
Coordination with vendors (responsible disclosure)
Official recognition
and international dissemination
Contribute to the identification and remediation of vulnerabilities affecting technologies used across the entire industrial ecosystem.
Rely on real-world cases
to enhance skills and enrich practices.
Structure, share, and transmit knowledge derived from ICS PROJECT activities.
2026-06-16 | Medium – Use of Externally-Controlled Format String, (CVE-2026-10828) by Remi ONNO
2026-06-16 | High – Stack-based Buffer Overflow, (CVE-2026-10829) by Remi ONNO
