ics security

A coordinated advisory published for the Zenitel TCIV-3+ intercom — attributed to Claroty Team82 researchers Nir Tepper and Noam Moshe and distributed via government channels — warns of multiple critical, remotely exploitable vulnerabilities including several OS command‑injection flaws, an...

Schneider Electric has published an urgent security notification and accompanying fixes for multiple vulnerabilities in PowerChute Serial Shutdown; operators should treat this as a high-priority patching and hardening task because the issues include path traversal, insufficient brute‑force...

Rockwell Automation’s disclosure that the Studio 5000 Simulation Interface ships with two high‑severity flaws — a path‑traversal/local code execution bug and a local SSRF that can force outbound SMB connections to harvest NTLM hashes — sharpens a familiar but urgent warning for ICS/OT operators...

General Industrial Controls’ Lynx+ Gateway has been flagged in a CISA advisory as containing multiple high‑severity vulnerabilities that are remotely exploitable with low complexity — including weak password requirements, missing authentication checks on critical web server functions, and...

Cyble’s weekly vulnerability roundup paints a stark picture: defenders are being flooded with high-severity flaws, public Proof‑of‑Concepts (PoCs), and—critically—several vulnerabilities that threaten both IT estates and the physical world of airports and industrial control systems. Background /...

A carefully packaged advisory claiming multiple high‑severity vulnerabilities in Advantech DeviceOn/iEdge has been circulated in CSAF format; it lists four CVE identifiers (CVE‑2025‑64302, CVE‑2025‑62630, CVE‑2025‑59171, CVE‑2025‑58423), assigns CVSS v3 and v4 scores in the high range (up to...

Radiometrics’ VizAir—a piece of equipment trusted at airports worldwide to detect wind shear and other hazardous low‑level wind phenomena—has been the subject of an urgent security advisory that elevates the product from “operational asset” to high‑risk attack surface for aviation...

CISA’s latest bulletin delivers a targeted wake-up call for operators and administrators of industrial control systems: five advisories were released addressing vulnerabilities in widely deployed ICS products, touching vendors from ABB and Siemens to Carrier and niche tooling used for protocol...

CISA’s publication of a package of ten Industrial Control Systems (ICS) advisories is a wake‑up call to every Windows administrator, OT engineer, and security leader who manages the overlap of enterprise IT and operational technology: these vulnerabilities span PLCs, HMIs, engineering...

CISA Releases Thirteen Industrial Control Systems Advisories — what operators, integrators and security teams must do next by [Staff Reporter], October 16, 2025 CISA published a consolidated release of thirteen Industrial Control Systems (ICS) advisories on October 16, 2025, calling attention to...

Hitachi Energy’s MACH GWS gateways have been placed squarely in the crosshairs of coordinated vulnerability disclosures this spring, with multiple flaws that can impact confidentiality, integrity and—most pressingly—availability in operational networks; CISA republished Hitachi’s advisory...

Siemens has published an urgent security advisory for its SIMATIC ET 200SP communication processors after a critical authentication weakness (CVE-2025-40771) was found in CP 1542SP-1 and CP 1543SP-1 variants: affected firmware versions prior to V2.4.24 do not properly authenticate configuration...

Rockwell Automation has published an urgent security advisory disclosing two high‑severity local privilege‑escalation flaws in FactoryTalk Linx that allow an authenticated Windows user to elevate to SYSTEM by abusing MSI “repair” behavior — vulnerabilities tracked as CVE‑2025‑9067 and...

Rockwell Automation has confirmed two high-severity denial-of-service vulnerabilities in the 1715 EtherNet/IP Communications Module that can be exploited remotely and have been assigned CVE‑2025‑9177 and CVE‑2025‑9178; vendor fixes are available in firmware/software version 3.011 and later...

CISA released two Industrial Control Systems (ICS) advisories that appear in public feeds for October 2, 2025, underscoring yet again the steady stream of vulnerability disclosures affecting OT environments — but the official CISA page referenced in the initial report was unreachable at the time...

CISA’s release of six Industrial Control Systems advisories on September 23, 2025, spotlights a fresh wave of vulnerabilities affecting widely deployed PLCs, RTUs, and gateway devices from AutomationDirect, Mitsubishi Electric, Schneider Electric, Viessmann (Vitogate 300), and Hitachi Energy — a...

Mitsubishi Electric has confirmed a remotely exploitable denial‑of‑service vulnerability in several MELSEC‑Q Series CPU modules that can be triggered when the device’s user authentication function is enabled; the flaw, tracked as CVE‑2025‑8531 with a CVSS v3.1 base score of 6.8, is caused by...

Hitachi Energy’s Service Suite is the subject of a high‑severity security advisory republished by vendor PSIRT and reflected in government guidance: a deserialization flaw tied to Oracle WebLogic (CVE‑2020‑2883) is implicated in the Service Suite advisory, and the combined risk profile is rated...

Hitachi Energy’s Asset Suite — a widely deployed enterprise asset management platform in the energy sector — was the subject of a republished security advisory that consolidates multiple open‑source component vulnerabilities with serious operational impact potential, and operators must act now...

Schneider Electric has published coordinated advisories describing two OS command injection flaws in the BLMon monitoring console used by Saitel DR and Saitel DP Remote Terminal Units (RTUs), vulnerabilities that allow authenticated console users to inject and execute arbitrary shell commands...