CISA ICS Advisories 2025: Harden Windows and OT in Critical Infrastructure

CISA’s latest roundup of Industrial Control Systems advisories underscores a familiar — and accelerating — reality for Windows administrators and OT teams: vulnerabilities in industrial products are diverse, often high‑impact, and demand rapid, coordinated responses across both IT and OT domains. On and around September 4, 2025, CISA flagged a group of advisories covering Honeywell, Mitsubishi/ICONICS, Delta Electronics, and a transport‑sector protocol; the batch reiterates the critical need to treat ICS exposures as enterprise problems, not “someone else’s” issue.

Background / Overview​

Industrial Control Systems (ICS) advisories published by the Cybersecurity and Infrastructure Security Agency (CISA) consolidate vendor disclosures, CVE assignments, CVSS scoring, and practical mitigation advice for operators and security teams. These advisories are concise but technically focused — intended for control‑system engineers, integrators, and the Windows administrators who support the supervisory and engineering workstations that interface with ICS components.
Across the advisories mentioned in this release, common themes reappear: memory‑safety bugs (buffer overreads/underflows), weak or missing authentication in legacy protocols, cryptographic weaknesses in session handling, and Windows‑specific attack surface issues such as shortcut‑following (.LNK) behavior. CISA’s guidance typically recommends vendor updates where available, network segmentation, least‑privilege, and risk‑based compensating controls when patches are impractical.

---

The advisories at a glance​

• ICSA‑25‑247‑01 — Honeywell OneWireless Wireless Device Manager (WDM) (listed in the user summary)
• ICSA‑25‑217‑01 — Mitsubishi Electric / ICONICS Digital Solutions Multiple Products (Update A).
• ICSA‑25‑105‑07 — Delta Electronics COMMGR (Update A).
• ICSA‑25‑205‑03 — Honeywell Experion PKS (Update A).
• ICSA‑25‑191‑10 — End‑of‑Train and Head‑of‑Train Remote Linking Protocol (Update B).

Note: the Honeywell OneWireless WDM advisory historically appears in CISA’s archive (previous advisory code and date), and vendor and third‑party telemetry show that OneWireless WDM is tied to several Experion PKS vulnerabilities disclosed in 2025; however, the specific ICSA identifier presented in some aggregations (ICSA‑25‑247‑01) could not be verified as a distinct CISA advisory page in public indexes at the time of writing — treat that code as unconfirmed pending direct vendor/CISA indexing. Where particular advisory codes or dates are ambiguous, priority should be given to the individual CISA ICS pages and vendor security notices cited in this article. (cisa.gov, dbugs.ptsecurity.com)

---

Deep dive: what each advisory says (technical summary and mitigations)​

Mitsubishi Electric / ICONICS — ICSA‑25‑217‑01 (Update A)​

• Executive summary: CISA documents a Windows shortcut‑following (.LNK) vulnerability that allows information‑tampering via symbolic link creation, enabling elevated processes to write to arbitrary files accessible under the running account. The practical impact on deployed GENESIS64, GENESIS, and MC Works64 installations includes potential denial‑of‑service or file corruption on affected Windows workstations.
• Severity and vector: CVE‑2025‑7376; CISA lists a CVSS v3.1 base score and computes CVSS v4 as lower (reflecting local privilege and user‑interaction requirements). The vulnerability is not remotely exploitable without an initial foothold. (cisa.gov, incibe.es)
• Key mitigations:
• Upgrade GENESIS to the vendor‑released fixed version (GENESIS 11.01 where applicable).
• Restrict remote access and require administrative logins for machines with the ICS product installed.
• Apply strict file permissions and prevent non‑admin users from writing to application files or directories accessed by elevated components.
• Independent corroboration: national CERT summaries and vulnerability feeds reflect the same CVE and remediation guidance, confirming the technical findings and recommended update.

Why this matters for Windows teams: ICONICS and MC Works64 run on Windows systems and often under accounts with elevated privileges; local tricks that cause elevated processes to write arbitrary content can escalate a seemingly low‑privilege compromise into system‑level disruption. Ensuring least‑privilege desktop operation, limiting local accounts, and hardening Windows hosts remains a top remediation priority.

Delta Electronics — ICSA‑25‑105‑07 (COMMGR)​

• Executive summary: COMMGR’s virtual PLC/service exposes a cryptographically weak PRNG used for session ID generation. The flaw allows session‑ID brute‑forcing and authentication bypass, yielding remote code execution against the AS3000Simulator family on exposed installations. CISA assigns a high severity and notes the vulnerability was reported via Trend Micro’s Zero Day Initiative (ZDI). (cisa.gov, zerodayinitiative.com)
• Severity and vector: CVE‑2025‑3495; CISA reports CVSS v4 ≈ 9.3 (remote, low complexity). ZDI’s advisory and CISA align on the exploitability and the default listening port commonly involved (a service that accepts simulator connections). (cisa.gov, zerodayinitiative.com)
• Key mitigations:
• Apply vendor fixes for COMMGR v2 when available; note that COMMGR v1 is EOL and requires compensating controls.
• Minimize network exposure: firewall/service ACLs to block access to simulator/service ports (default TCP 8895 where observed).
• Isolate the programming/engineering network and never expose programming interfaces to untrusted networks.
• Independent corroboration: ZDI’s public advisory confirms the vulnerability mechanics, CVE assignment, and remediation timeline.

Operational note: COMMGR’s management functionality and simulator features make it tempting to place on broader enterprise subnets — that convenience materially increases risk. If patching is delayed, strictly restrict network reachability to the smallest set of management hosts.

Honeywell Experion PKS — ICSA‑25‑205‑03 (Update A)​

• Executive summary: Honeywell’s Experion PKS contains multiple memory and handling errors across components (uninitialized variables, buffer issues, integer underflow, handler misdeployment). CISA lists multiple CVEs (for example, CVE‑2025‑2520, CVE‑2025‑2521, CVE‑2025‑2523) with high CVSS scores and explicitly recommends hotfix updates for specific release branches (R520.2 TCU9 HF1 or R530 TCU3 HF1). Positive Technologies is credited as the reporter. (cisa.gov, dbugs.ptsecurity.com)
• Severity and vector: at least one CVE (integer underflow) carries a CVSS v3.1 in the high range (and one CVSS v4 entry reported as 9.4 on CISA). Vulnerabilities are described as remote‑exploitable in the advisory text.
• Key mitigations:
• Apply Honeywell’s hot fixes for the affected release branches immediately where feasible.
• If immediate patching is impractical, enforce network segmentation, isolate Experion components from the internet, and restrict access to engineering workstations.
• Independent corroboration: vulnerability trackers (Tenable) and Positive Technologies’ writeups align with CISA’s details, and third‑party vulnerability databases confirm the CVE IDs and version ranges. These independent sources also note that some of the PKS issues overlap with OneWireless WDM component concerns. (tenable.com, dbugs.ptsecurity.com)

Operational impact: Experion PKS is a distributed control system used across chemical, energy, and water industries; a successful RCE or DoS here could produce both operational downtime and safety risks. Prioritize planning and staged, tested updates.

Honeywell OneWireless WDM — (historically documented advisory)​

• Summary and verification: OneWireless WDM (Wireless Device Manager) has been the subject of prior CISA advisories (historically ICSA‑23‑075‑06) documenting command injection, weak randomness, and missing authentication issues. Positive Technologies and other researchers later correlated some Experion PKS issues with OneWireless components — vendor fixes and version updates (e.g., OneWireless version 322.5/331.1) were referenced in patch guidance for related CVEs. However, the specific 2025 advisory code ICSA‑25‑247‑01 cited in some listings could not be located in public CISA indexing at the time of this piece; the underlying technical overlap (PKS + OneWireless component vulnerabilities) is corroborated by vendor and research disclosures. Treat the code as unverified and rely on the explicit CISA PKS/OneWireless advisories and vendor security notices for remediation steps. (cisa.gov, dbugs.ptsecurity.com)

Why this matters: OneWireless WDM runs services that interact closely with field devices and the PKS control plane. Vulnerabilities in OneWireless often translate into higher adversarial leverage because they bridge radio‑connected field gear and the supervisory network.

End‑of‑Train / Head‑of‑Train Remote Linking Protocol — ICSA‑25‑191‑10​

• Executive summary: This advisory addresses a protocol‑level weakness in the End‑of‑Train / Head‑of‑Train remote linking protocol (used to link locomotive head and trailing end units). The protocol’s reliance on a simplistic BCH checksum allows crafted packets (via software‑defined radio) to impersonate legitimate packets and transmit brake control commands. CISA assigns CVE‑2025‑1727 and computes CVSS v4 ~7.2 (weak authentication).
• Impact: An attacker with RF access could issue brake commands or disrupt brake behavior, leading to operational disruption and potential safety consequences. This is a transportation sector protocol concern; manufacturers and standards bodies (AAR/RESC) are pursuing longer‑term protocol replacements. (cisa.gov, mbgsec.com)
• Mitigations:
• Operators should work with AAR and device manufacturers for upgrade roadmaps.
• Short‑term mitigations include physical security of RF environments, RF monitoring for anomalous transmissions, and restricting device maintenance that accepts remote linking to authenticated channels where possible.

The transport advisory is a useful reminder that not all high‑risk ICS issues are software bugs — some are protocol and design weaknesses in field communications that require standards‑level interventions.

---

What these advisories mean for Windows administrators and enterprise security teams​

• ICS advisories increasingly touch Windows directly. Many ICS engineering, HMI, and historian products are Windows‑based; Windows client security becomes an OT safety control.
• A common pattern: an attacker obtains low‑privileged code execution (phishing, malicious installer, lateral movement) on a Windows engineering host, then leverages product‑specific flaws (e.g., .LNK handling or privileged write paths) to escalate or corrupt ICS data. Preventing initial compromise of Windows hosts is therefore essential to ICS resilience.
• Patching constraints: many ICS environments cannot accept rapid, broad patches due to uptime and safety priorities. That reality makes network segmentation, host isolation, and compensating controls the practical first line of defense in many operational environments. CISA repeatedly emphasizes this approach.

---

Practical, prioritized remediation checklist (for IT + OT teams)​

• Inventory and map: identify all systems that run the affected products (GENESIS64/MC Works64, COMMGR, Experion PKS, OneWireless components, and EoT/HoT devices). Track versions and patch status.
• Apply vendor fixes: where patches or hotfixes exist, test in a staging environment and accelerate deployment to production as allowed by safety/operational constraints. Prioritize:
• Honeywell Experion hotfix releases (R520.2 TCU9 HF1 / R530 TCU3 HF1).
• Mitsubishi/ICONICS GENESIS 11.01 or vendor‑provided patches.
• Delta COMMGR fixes for supported v2 installs; treat v1 as EOL and isolate.
• Network controls: block unnecessary inbound access to ICS ports from enterprise networks and the internet; deploy granular ACLs and microsegmentation where feasible. Place engineering workstations behind hardened jump hosts with MFA.
• Harden Windows hosts:
• Enforce least privilege for operator accounts.
• Disable automatic execution of .LNK / removable media where feasible; apply application control and allow‑listing for engineering tools.
• Maintain up‑to‑date EDR/AV with OT‑aware telemetry and central logging.
• Monitor and detect: tune IDS/IPS, OT‑network monitoring, and SIEM rules to detect anomalous behavior (brute‑force session attempts, unusual .LNK activity, unexpected RF transmissions in transportation).
• Plan for legacy: where vendors do not patch older SKUs, implement compensating controls and product replacement roadmaps. Document risk and acceptance decisions.
• Coordinate reporting and threat intel: share IOCs or anomalous events with CISA or sector ISACs; follow vendor PSIRTs for updates.

---

Critical analysis — strengths, limitations, and operational risks​

Strengths of CISA’s advisory process​

• Timely aggregation: CISA brings vendor technical details and mitigations into a single, consumable advisory that operational teams can act upon quickly.
• CVE and scoring integration: advisories provide CVSS vectors and CVE references, helping risk scoring workflows and executive prioritization.
• Practical mitigations: when patches aren’t available, CISA consistently recommends pragmatic, defense‑in‑depth measures (segmentation, VPN restrictions, least‑privilege), which align with OT risk realities.

Limitations and persistent gaps​

• Patch friction: vendor patches for ICS often require careful operational testing and change control, meaning the window of exposure can remain long. Some products reach EOL (e.g., COMMGR v1), leaving defenders to rely on compensating controls.
• Protocol/design flaws: issues like weak authentication in legacy RF protocols (EoT/HoT) are not solvable by a simple patch — they require standards updates, device replacement, or physical/operational mitigations, which are slow and costly.
• Visibility gaps: many OT networks lack holistic telemetry; Windows teams must partner with OT engineers to gain asset visibility and to instrument detection across the IT/OT boundary.

Risk tradeoffs for Windows teams​

• Aggressive patching of Windows hosts is essential but insufficient: attackers increasingly exploit product‑level behaviors (application permissions, local service interactions) beyond the OS itself. Windows hardening must be paired with application configuration controls and rigorous credential management.
• Reliance on VPNs as “secure remote access” can create false confidence. CISA explicitly notes VPNs are only as secure as the connected host; unmanaged or compromised engineering workstations can nullify VPN protections.

---

What operators and security leaders should do next (executive summary)​

• Treat ICS advisories as enterprise‑level risk items: assign accountable owners, set remediation SLAs, and document compensating controls where immediate patching is impossible.
• Increase collaboration between Windows/IT teams and OT engineers: joint vulnerability triage sessions accelerate safe testing and deployment of vendor patches.
• Invest in ICS visibility and monitoring: the single biggest operational boost comes from knowing where assets are, how they communicate, and what “normal” looks like.
• Build phased replacement plans for legacy, unpatchable devices and protocol vulnerabilities (e.g., EoT/HoT RF weakness), and engage vendors and standards bodies where protocol redesign is required.

---

Conclusion​

The set of advisories consolidated in CISA’s recent advisories is not exceptional in thematic content — memory corruption, weak cryptography, and protocol design flaws recur across ICS disclosures — but the pace and breadth of these notices matter. They reiterate an unambiguous message: protecting ICS requires integrated action across Windows operations, network architecture, vendor management, and OT engineering. Patches are only part of the solution. For many organizations, the immediate defensive gains come from disciplined inventory, aggressive segmentation, least‑privilege enforcement on Windows engineering hosts, and a clear operational plan for legacy equipment.
CISA’s advisories — together with vendor PSIRTs, ZDI notes, and independent vulnerability trackers — provide the technical roadmap. The operational challenge is execution under the real constraints of safety, uptime, and prolonged product life cycles. Security teams that treat these advisories as actionable, prioritized operational tasks — and that align Windows hardening with OT controls — will materially reduce exposure and better protect critical infrastructure from the next wave of exploitation.

---

Source: CISA CISA Releases Five Industrial Control Systems Advisories | CISA