Sounding the Alarm on Emergency Alert System Flaws
Summary: DHS urged states and localities to harden the proprietary devices connected to the Emergency Alert System ahead of a DEFCON workshop where researcher Ken Pyle planned to demonstrate multiple weaknesses in the national warning system. Pyle began buying used EAS encoder/decoders on eBay in 2019, found serious flaws in a widely deployed Digital Alert Systems device, reported them to DHS, the FBI and the manufacturer, and says nothing happened until he went public; the vendor says it patched the issues in firmware beginning October 2019 but that some customers still run outdated versions, and many older models do not support version 4.
Bottom line: Pyle's core finding is that compromising a single EAS station is enough to push alerts that other systems retransmit nationwide, and one discarded device he obtained still held the private keys and credentials for sending alerts through Comcast, the country's third-largest cable company.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026