industrial control systems

CISA’s consolidated bulletin announcing nine new Industrial Control Systems (ICS) advisories is a blunt reminder that the operational-technology (OT) landscape — and the Windows systems that often bridge to it — remain under persistent attack and demand coordinated, prioritized remediation. The...

CISA on March 20, 2025 published five new Industrial Control Systems (ICS) advisories that flag high‑risk flaws across multiple vendors — Schneider Electric (two advisories), Siemens, SMA Solar Technology, and Santesoft — and urge operators to apply patches and mitigations immediately...

CISA has quietly added CVE-2021-26829 — a stored Cross‑Site Scripting (XSS) vulnerability in OpenPLC’s ScadaBR HMI — to its Known Exploited Vulnerabilities (KEV) Catalog, signaling immediate operational urgency for federal agencies and a practical priority marker for organizations that operate...

CISA’s latest consolidated advisory package is a stark reminder that industrial control systems (ICS) remain a high‑value target for attackers and a bridge between operational technology (OT) and enterprise IT — the agency published a bundle of seven ICS advisories that name multiple widely...

SiRcom’s SMART Alert (SiSA) central control software contains a remote, high‑impact authentication bypass that — if left unmitigated — could let unauthenticated actors trigger or manipulate outdoor sirens and other emergency alerting actions from the network, with direct safety and public‑trust...

CISA’s latest consolidated package of Industrial Control Systems advisories puts a fresh set of products — notably several Schneider Electric components and a Yokogawa recorder family — in the spotlight, urging operators to apply mitigations, review configurations, and treat OT exposure as an...

CISA’s latest package of Industrial Control Systems (ICS) advisories is a blunt reminder that adversaries continue to probe and exploit the operational technology (OT) layer — and that Windows-centric IT teams are often the fastest path from a network foothold to physical process disruption. The...

Siemens ProductCERT has published SSA‑682326, a consolidated security advisory documenting multiple high‑severity vulnerabilities in COMOS that affect releases prior to V10.4.5, and operators must treat this as an urgent software‑supply‑chain and operational‑security issue: the advisory...

CISA published four new Industrial Control Systems advisories on June 10, 2025, flagging high‑severity flaws in four widely used products — SinoTrack GPS receiver devices, Hitachi Energy Relion protection relays and SAM600‑IO I/O modules, MicroDicom DICOM Viewer, and the Assured Telematics (ATI)...

Delta Electronics’ CNCSoft‑G2 HMI has an urgent file‑parsing vulnerability — tracked as CVE‑2025‑58317 — that allows arbitrary code execution when a user opens a specially crafted file; the flaw is rated high severity (CVSS v3.1 ≈ 7.8, CVSS v4 ≈ 8.5) and affects builds prior to the vendor’s...

Veeder‑Root’s TLS4B automatic tank gauge (ATG) family is at the centre of a high‑risk industrial security advisory: the consoles expose a SOAP/web‑services surface that can be abused for remote command execution, and a separate time‑handling defect tied to the Unix 2038 epoch rollover can crash...

CISA has published a package of eight Industrial Control Systems (ICS) advisories that consolidate vendor disclosures and urgent mitigation guidance for a range of widely deployed automation, building‑management, and medical imaging products — a release that Windows administrators, OT engineers...

Siemens ProductCERT has confirmed two high‑severity vulnerabilities in the SIMATIC S7‑1200 CPU V1/V2 families that can be exploited remotely to either crash controllers into a stop/defect state or replay previously recorded engineering‑level commands — a pair of flaws that demand immediate...

Siemens has published an emergency patch for a critical flaw in TeleControl Server Basic after security researchers disclosed an information‑disclosure bug that lets unauthenticated remote attackers obtain password hashes from the product’s database service — a vulnerability tracked as...

CISA’s latest ICS bulletin republishes a focused alert: an advisory for the Dingtian DT‑R002 relay board (ICSA‑25‑268‑01), which CISA published on September 25, 2025 — not October 14 — and which documents two insufficiently protected credentials vulnerabilities that allow unauthenticated...

CISA’s January 10 advisory bundle underscored a familiar but dangerous reality for operators of industrial control systems: several widely deployed OT products shipped with high-impact defects that can be exploited through routine file handling, legacy third‑party components, or simple network...

On March 11, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) published two Industrial Control Systems (ICS) advisories covering vulnerabilities in Schneider Electric’s Uni‑Telway driver and Optigo Networks’ Capture Tool software — advisories that carry meaningful operational...

The Cybersecurity and Infrastructure Security Agency (CISA) published a package of ten Industrial Control Systems (ICS) advisories that together underscore a widening attack surface across operational technology (OT) and the Windows‑managed environments that support it. Background Industrial...

Festo’s CECC-S, CECC-LK and CECC-D controllers were flagged in a high-severity CISA advisory today after multiple, remotely exploitable flaws in the embedded CODESYS V3 runtime were discovered — the alert (ICSA‑25‑273‑04) assigns a CVSS v3 score of 9.8 and warns operators that unpatched devices...

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory on a critical remote code execution vulnerability in MegaSys’s Telenium Online web application, a network‑management platform widely used in telecommunications, energy and government environments; the flaw...