cisa advisory

Dover Fueling Solutions’ ProGauge MagLink family is at the center of a critical industrial‑control security alert that should be on every fuel‑site operator’s incident response checklist today: the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a high‑severity advisory...

Schneider Electric has published coordinated advisories describing two OS command injection flaws in the BLMon monitoring console used by Saitel DR and Saitel DP Remote Terminal Units (RTUs), vulnerabilities that allow authenticated console users to inject and execute arbitrary shell commands...

Delta Electronics’ DIALink — a widely used industrial automation server — is the subject of a coordinated vulnerability disclosure that identifies two directory‑traversal / authentication‑bypass flaws (CVE‑2025‑58320 and CVE‑2025‑58321) affecting DIALink versions V1.6.0.0 and earlier, and urges...

Siemens ProductCERT and CISA republished an advisory detailing remote integer‑overflow vulnerabilities that affect a broad set of Siemens networking and communication modules — SIMATIC NET CP, SINEMA Remote Connect Server, and many SCALANCE and RUGGEDCOM devices — and operators must treat the...

Siemens and upstream OpenSSL vulnerabilities that allow out-of-bounds reads — tracked under CVE-2021-3712 — remain a live operational risk across dozens of Siemens industrial networking, communications, and automation products; Siemens has published ProductCERT guidance and fixes for many...

A newly disclosed Cross‑Site Scripting (XSS) vulnerability, tracked as CVE‑2025‑7746, affects a broad set of Schneider Electric Altivar drives and modules — including the ATVdPAC module (fixed in VW3A3530D version 25.0), multiple Altivar Process and Machine drives, and the ILC992 InterLink...

Schneider Electric has published fixes and CISA republished an advisory after coordinated disclosure of two vulnerabilities in EcoStruxure Building Operation / Enterprise Server and associated Workstation components that could enable an authenticated, adjacent‑network attacker to cause a...

Siemens’ cloud-hosted SIMATIC Virtualization as a Service (SIVaaS) has been found to expose a network share without authentication — a configuration defect that Siemens has cataloged as CVE-2025-40804 and scored as critical (CVSS v3.1 = 9.1; CVSS v4 = 9.3). This flaw allows unauthenticated...

CVE-2025-54109 Windows Defender Firewall Service Elevation of Privilege Vulnerability Summary What it is: CVE-2025-54109 is an elevation-of-privilege (EoP) vulnerability described by Microsoft as "Access of resource using incompatible type ('type confusion')" in the Windows Defender Firewall...

Rockwell Automation’s 1783‑NATR I/O adapter has been flagged by CISA as vulnerable to a third‑party component flaw that can cause memory corruption, carrying a CVSS v4 base score of 6.9 and described as remotely exploitable with low attack complexity — operators should treat it as an immediate...

A newly republished advisory from CISA and Rockwell Automation raises urgent operational and security flags for organizations using the CompactLogix® 5480 controller family: the devices running specific Windows packages are affected by a Missing Authentication for Critical Function vulnerability...

A remote information‑disclosure weakness in Mitsubishi Electric’s MELSEC iQ‑F series CPU modules has been publicly described as a cleartext transmission of sensitive information over SLMP, enabling an attacker with network access to capture credentials and potentially read/write device values or...

Mitsubishi Electric’s MELSEC iQ‑F family of CPU modules has been formally flagged with a network‑accessible vulnerability that allows unauthenticated remote actors to read and write device values — and in some deployments to halt program execution — because the affected product’s Modbus/TCP...

CISA has added a critical Citrix NetScaler vulnerability — CVE-2025-7775 — to its Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation, prompting an urgent patch-and-verify cycle for NetScaler ADC and NetScaler Gateway operators worldwide. Background CVE-2025-7775...

Schneider Electric has acknowledged a high-severity vulnerability in its Modicon M340 family and several M340 communication modules that can be triggered remotely by a specially crafted FTP command and may cause a denial-of-service condition; the flaw was assigned CVE‑2025‑6625 and carries a...

FUJIFILM Healthcare Americas’ Synapse Mobility contains a web-parameter privilege-escalation flaw—tracked as CVE-2025-54551—that can be exploited remotely to bypass role-based access controls and expose protected imaging data, and CISA’s emergency medical advisory urges immediate upgrades to...

Siemens’ SIPROTEC 5 family has resurfaced in industry advisories after researchers and the vendor disclosed a vulnerability that allows attackers with physical access to exhaust a device’s memory via its local USB port, causing temporary loss of network responsiveness; the issue is tracked as...

Rockwell Automation’s Micro800 line of programmable logic controllers (PLCs) has been the subject of a high-severity U.S. Cybersecurity and Infrastructure Security Agency (CISA) advisory republished on August 14, 2025, warning that multiple remotely exploitable vulnerabilities tied to Azure RTOS...

A newly republished CISA advisory warns that Rockwell Automation’s Studio 5000 Logix Designer contains an improper input validation flaw that can be triggered via environment variables, allowing an attacker with local network access to crash the engineering software—and in some cases plausibly...

Rockwell Automation has issued—and CISA has republished—an advisory warning that specific 1756-series communication modules can enter a Major Non‑Recoverable fault or crash when presented with malformed or concurrent Forward Close messages, creating a practical denial‑of‑service risk for...