ot security

Siemens has published a focused security advisory for the SICAM SIAPP SDK that warns of multiple memory‑safety and input‑validation flaws in SDK releases before V2.1.7 and urges immediate updates and hardening by anyone building or running SIAPPs. The defects — which Siemens characterizes as an...

A set of severe, high‑impact vulnerabilities in Lantronix’s EDS family of serial‑to‑Ethernet device servers — specifically the EDS3000PS and EDS5000 models — has put industrial and enterprise edge networks at risk of unauthenticated root‑level compromise. The U.S. Cybersecurity and...

Mitsubishi Electric has disclosed a cluster of high‑impact denial‑of‑service vulnerabilities affecting the MELSEC iQ‑F Series EtherNet/IP and Ethernet modules that, if left unmitigated, can be weaponized by a remote attacker to render communications unavailable and force a device reset — with...

Hitachi Energy's RTU500 family is the subject of a fresh set of security advisories that enumerate multiple firmware-level flaws capable of leaking low-value user management data and causing device outages — vulnerabilities operators must treat as urgent because the affected components sit at...

Nexcom’s latest Embedded World showcase is a clear signal that industrial PC vendors are doubling down on fanless reliability, local AI capability, and ruggedized edge platforms — the company has unveiled the APPC C21‑01 fanless panel PC family for factory HMIs, a Jetson‑powered robotics...

Johnson Controls’ Frick Controls Quantum HD family has been pushed into the center of a new industrial‑control security storm after a coordinated advisory flagged a cluster of high‑severity remote vulnerabilities that — if chained or exploited at scale — could let unauthenticated attackers run...

Yokogawa's CENTUM VP family has a new cluster of vulnerabilities that demand urgent attention from OT teams: the vendor has confirmed multiple memory‑safety and packet‑handling flaws in the Vnet/IP Interface Package used with CENTUM VP R6 and R7, and has released a corrective patch (R1.08.00)...

Schneider Electric has published an urgent security notice for EcoStruxure Building Operation (EBO) after researchers disclosed two high‑impact vulnerabilities—CVE‑2026‑1226 and CVE‑2026‑1227—that can be triggered by crafted TGML graphics files and may allow local file disclosure...

Microsoft’s DTECH 2026 messaging is blunt: the utility sector is past the era of proof‑of‑concepts and into a phase where AI, unified IT/OT data, and partner-driven architectures must deliver repeatable operational outcomes — not pilots. Across the show floor and Microsoft‑led sessions, the...

Siemens has confirmed that multiple products running SINEC OS versions earlier than 3.3 include third‑party components with dozens of security flaws — a broad, high‑impact update that requires immediate attention from operators of RUGGEDCOM and SCALANCE devices, and from any team responsible for...

CISA’s new guidance, "Barriers to Secure OT Communication: Why Johnny Can’t Authenticate," bluntly reframes a long-standing truth for industrial operators: the cryptographic and authentication features necessary to stop simple, high-impact attacks exist in many pockets, yet they are rarely...

Dragos’s expanded collaboration with Microsoft marks a decisive step in bringing purpose-built operational technology (OT) security into mainstream enterprise cloud and security operations: the Dragos Platform will run on Microsoft Azure, feed OT telemetry and asset context into Microsoft...

Dragos’s expanded collaboration with Microsoft marks a significant step toward bringing purpose-built operational technology (OT) security into mainstream enterprise cloud and security operations: the Dragos Platform will run on Microsoft Azure, push OT-specific telemetry and asset context into...

A remotely exploitable, high‑severity vulnerability in the Synectix LAN 232 TRIO serial‑to‑Ethernet adapter (CVE‑2026‑1633) leaves the device’s web management interface completely unprotected, allowing unauthenticated attackers to change critical configuration, erase device state, or...

A critical, high‑impact vulnerability in Johnson Controls’ Metasys product line — tracked as CVE‑2025‑26385 in vendor advisories — demands immediate attention from building‑automation teams, Windows administrators, and any organization that uses Metasys ADS/ADX servers, LCS/NAE appliances or the...

Johnson Controls’ iSTAR Configuration Utility (ICU) tool has a newly disclosed vulnerability — a stack‑based buffer overflow assigned CVE‑2025‑26386 — that can crash the Windows host running the utility and, in certain conditions, enable more severe host‑impact outcomes if exploited. The...

Two newly disclosed vulnerabilities in Rockwell Automation’s Verve Asset Manager expose plaintext secrets in retired, optional components — a wake-up call for OT teams that still run legacy modules and for Windows‑centric engineering workstations that serve as gateways into industrial networks...

CISA and the UK National Cyber Security Centre have jointly published practical guidance—Secure Connectivity Principles for Operational Technology (OT)—offering an eight‑point framework to design, secure, and manage connectivity into OT environments as organizations face rising business...

CISA’s latest notice that it has released two Industrial Control Systems advisories underscores a simple but urgent fact: vulnerabilities in operational technology (OT) and medical-device software continue to present high-impact risks to critical infrastructure and patient safety, and they...

CISA’s latest consolidated bulletin parcels out nine Industrial Control Systems (ICS) advisories that expose a familiar — and escalating — set of risks: remotely exploitable firmware and protocol flaws, weak authentication and hard-coded credentials, and insecure management interfaces that...