Critical Flaws in 3rd-Party Code Allow Takeover of Industrial Control Systems