industrial cybersecurity

A cluster of vulnerabilities affecting AutomaapplicationDirect’s CLICK PLUS family has put hundreds of engineering projects and live control systems at elevated risk: exposed credentials in project files, weak or hard-coded cryptography in firmware, and autwhorization and resource-handling...

Siemens has published a security advisory confirming two medium‑to‑high severity vulnerabilities in SINEC Security Monitor that affect all releases prior to V4.10.0, and operators are urged to update to V4.10.0 or later immediately to eliminate both the authorization bypass in the ssmctl-client...

Siemens has warned that a flaw in the way several SIMATIC and SIPLUS ET 200 devices handle S7 protocol session disconnects can be weaponized to cause a denial‑of‑service (DoS) condition: a properly formed S7 Disconnect Request (a COTP DR TPDU) sent to TCP port 102 may push the device into an...

Rockwell Automation’s FactoryTalk DataMosaix Private Cloud contains a high‑severity SQL injection vulnerability that lets low‑privilege users perform sensitive database operations through exposed API endpoints — a flaw assigned CVE‑2025‑12807 with a CVSS v3.1 base score of 8.8 (CVSS v4 ≈ 8.7)...

Rockwell Automation has confirmed a high‑severity denial‑of‑service vulnerability in the GuardLink EtherNet/IP interface on its 432ES‑IG3 Series A safety module (CVE‑2025‑9368), a flaw that can render the module unresponsive over the network and requires a manual power cycle to restore service —...

CISA has published an Industrial Control Systems advisory that consolidates vendor fixes and concrete mitigation guidance for a deserialization vulnerability in Schneider Electric’s EcoStruxure Power Monitoring Expert (PME), tracked as CVE-2024-9005, and operators running PME 2022 and earlier...

Rockwell Automation has published an urgent advisory after internal fuzz-testing uncovered two controller defects that can crash or fault Micro800-series devices: an IPv6 stack fault that produces recoverable controller faults (CVE-2025-13823) and a malformed-CIP handling flaw that can drive...

A critical remote-code and information‑exposure risk has been disclosed in the software keyboard (“keypad”) function used by ICONICS GENESIS64, ICONICS Suite, MobileHMI and Mitsubishi Electric’s MC Works64 — a flaw that can allow an attacker to force execution of arbitrary EXE files when a...

Siemens has disclosed a serious vulnerability in the Interniche TCP/IP stack that underpins networking in a broad array of industrial devices and controllers; the flaw (tracked as CVE‑2025‑40820) can allow an unauthenticated remote attacker who can inject spoofed IP packets at precisely timed...

Schneider Electric has confirmed that its EcoStruxure Foxboro DCS Advisor service is affected by a critical Microsoft Windows Server Update Services (WSUS) vulnerability — tracked as CVE‑2025‑59287 — and operators must prioritize out‑of‑band WSUS patches and layered mitigations to avoid a...

AzeoTech’s DAQFactory has been the subject of a high‑severity industrial control systems (ICS) advisory: multiple memory‑safety and parsing flaws in DAQFactory Release 20.7 (Build 2555) and earlier can be triggered by specially crafted project files (.ctl), and the vendor has released a...

A high‑severity Man‑in‑the‑Middle (MitM) weakness in Siemens’ IAM client has been publicly disclosed and tracked as CVE‑2025‑40800: the client omits proper server certificate validation when establishing TLS connections to Siemens’ authorization servers, creating an exploitable channel for...

Siemens has confirmed a firmware-integrity weakness that affects several access-controller families and could let an attacker install modified firmware on door controllers — a scenario that turns a physical-access appliance into a persistent foothold. The vulnerability, tracked as CVE‑2022‑31807...

Siemens has published a coordinated security advisory for Gridscale X Prepay that assigns two new CVE identifiers — CVE‑2025‑40806 and CVE‑2025‑40807 — describing a remotely exploitable user enumeration flaw and an authentication token capture‑replay weakness; Siemens recommends updating all...

Johnson Controls’ iSTAR Ultra family has been the subject of coordinated security advisories after multiple remote OS command‑injection and related firmware‑integrity weaknesses were disclosed; attackers who successfully chain these issues could modify firmware, gain root access, and take full...

Siemens ProductCERT published a focused advisory on December 9, 2025, confirming a physical authentication‑bypass vulnerability in Elspec G5 Digital Fault Recorder (G5DFR) devices used in Siemens Energy Services deployments that allows an attacker with physical access to reset the Admin password...

Festo’s LX Appliance contains a cross‑site scripting (XSS) exposure tied to a third‑party video player library (video.js) that can be abused by a privileged user to inject script into administrative sessions — a practical, medium‑severity risk for training and control‑system deployments that...

Mitsubishi Electric has disclosed a serious information‑disclosure flaw in GX Works2 that leaves project‑level credentials stored in cleartext inside project files, enabling any actor with access to those files to extract authentication data, open protected projects, and read or alter control...

Advantech’s iView — a widely deployed industrial video monitoring and management platform — is the subject of a fresh, high‑priority coordinated advisory that catalogs multiple remote, authenticated and (in some cases) authenticated‑low‑privilege vulnerabilities that can lead to SQL injection...

A coordinated advisory published for the Zenitel TCIV-3+ intercom — attributed to Claroty Team82 researchers Nir Tepper and Noam Moshe and distributed via government channels — warns of multiple critical, remotely exploitable vulnerabilities including several OS command‑injection flaws, an...