industrial security

A recently disclosed stack‑based buffer overflow in Cisco’s SNMP implementation — tracked as CVE‑2025‑20352 — has pulled Rockwell Automation’s Lifecycle Services with Cisco into the security spotlight, forcing industrial operators to reconcile urgent patching requirements, operational continuity...

Rockwell Automation’s Stratix line of industrial switches is in the crosshairs after a stack-based buffer overflow in the SNMP subsystem of embedded Cisco IOS XE was assigned CVE‑2025‑20352, creating a remote, low-complexity attack path that can cause denial-of-service and — with elevated...

Raise3D’s Pro2 Series 3D printers were flagged in a federal industrial-control-systems advisory for an authentication bypass that can be triggered when the device’s developer mode is enabled — an unauthenticated debug/API path exposes the printer’s filesystem and sensitive functions, and the...

Festo control blocks CPX-CEC‑C1 and CPX‑CMXX contain a remotely exploitable weakness (CVE‑2022‑3079) that permits unauthenticated actors to trigger critical webpage functions — effectively allowing denial‑of‑service conditions and device reboots — and operators should treat any CPX devices...

Schneider Electric has published a coordinated security update after a high‑impact local flaw in its Software Update component (SESU) was assigned CVE‑2025‑5296 — a CWE‑59: Improper Link Resolution Before File Access (‘link following’) issue that affects SESU versions prior to 3.0.12 and...

Westermo’s industrial networking OS, WeOS 5, contains a remote-denial vulnerability that can trigger an immediate reboot when the device is configured for IPsec and sent a carefully crafted Encapsulating Security Payload (ESP) packet — an issue tracked as CVE‑2025‑46419 and documented by both...

Siemens’ cloud-hosted SIMATIC Virtualization as a Service (SIVaaS) has been found to expose a network share without authentication — a configuration defect that Siemens has cataloged as CVE-2025-40804 and scored as critical (CVSS v3.1 = 9.1; CVSS v4 = 9.3). This flaw allows unauthenticated...

Siemens has published a security advisory (SSA-027652) describing a privilege‑escalation vulnerability in its SINAMICS drive family that allows a factory reset and configuration manipulation without the required privileges, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA)...

Rockwell Automation’s ThinManager has been flagged for a high-severity Server-Side Request Forgery (SSRF) flaw that can expose an industrial control system’s ThinServer service account NTLM credentials, according to a federal advisory reissued on September 9, 2025. The vulnerability—tracked...

Delta Electronics’ engineering tool EIP Builder contains an XML External Entity (XXE) vulnerability (CVE-2025-57704) that can expose sensitive files when the application parses crafted XML, and vendors and national incident responders now recommend an immediate upgrade to mitigate the risk...

Siemens’ Simcenter Femap has received a fresh security spotlight: two file‑parsing vulnerabilities that allow local code execution when a user opens specially crafted STP or BMP files, and Siemens has published fixed versions while U.S. authorities have republished the advisory for awareness...

Rockwell Automation’s Micro800 line of programmable logic controllers (PLCs) has been the subject of a high-severity U.S. Cybersecurity and Infrastructure Security Agency (CISA) advisory republished on August 14, 2025, warning that multiple remotely exploitable vulnerabilities tied to Azure RTOS...

Siemens’ advisory covering third‑party components in SINEC OS landed as a stark reminder that industrial network stacks are only as strong as their weakest third‑party link: dozens of kernel and userland weaknesses, CVEs spanning classic buffer overflows to TOCTOU races, and a vendor‑centric...

A series of newly discovered vulnerabilities in Rockwell Automation’s Arena simulation software have jolted the industrial software ecosystem, underscoring the persistent security challenges faced by critical manufacturing sectors worldwide. Carrying a high CVSS v4 base score of 8.4, these...

A major security vulnerability has been discovered in Packet Power’s EMX and EG products, exposing critical infrastructure worldwide to the risk of unauthorized remote access and control. The vulnerability, designated CVE-2025-8284, allows attackers to bypass authentication entirely, offering a...

A significant security vulnerability has emerged for the Mitsubishi Electric ICONICS Product Suite and MC Works64, one that underscores the critical importance of proactive patch management and robust network segmentation across industrial environments. Marked as CVE-2025-7376, the flaw...

Rockwell Automation, a global leader in industrial automation and information technology, finds itself at the forefront of a critical security challenge following the recent disclosure of high-severity vulnerabilities in its Lifecycle Services solutions that leverage VMware technologies. These...

Schneider Electric’s EcoStruxure Power Operation (EPO) platform has long been positioned as a linchpin in the drive toward smarter, more resilient, and energy-efficient enterprises. Yet, as the digital transformation of critical infrastructure accelerates, the threat landscape inevitably...

The Cybersecurity and Infrastructure Security Agency (CISA) has recently issued three critical advisories concerning vulnerabilities in industrial control systems (ICS). These advisories highlight significant security flaws in products from Leviton, Panoramic Corporation, and Johnson Controls...

Siemens Solid Edge SE2025, widely deployed in critical manufacturing and engineering environments across the globe, has come under recent scrutiny following the disclosure of several significant vulnerabilities that could potentially compromise system integrity and user security. The urgency...