CISA ICS Advisories Sept 2, 2025: 4 High-Risk OT Vulnerabilities & Mitigations

CISA’s September 2, 2025 bulletin that released four new Industrial Control Systems (ICS) advisories is a stark reminder that operational technology (OT) and energy-sector devices remain high-value targets—and that defenders must move faster than vendors and attackers to close windows of exposure. The advisories cover Delta Electronics EIP Builder, Fuji Electric FRENIC‑Loader 4, SunPower PVS6, and an Update A to a previously published Hitachi Energy Relion advisory; each entry includes CVE identifiers, calculated CVSS scores, and concrete mitigation guidance for affected devices. These notices, published directly by the Cybersecurity and Infrastructure Security Agency (CISA), identify issues ranging from information disclosure to remote-code-execution and denial‑of‑service risks that can have operational and safety consequences. (cisa.gov)

---

Background​

Industrial Control Systems (ICS) advisories published by CISA are intended to provide operators, integrators, and IT/OT security teams with succinct technical summaries of vulnerabilities, the affected products and versions, and the mitigations or vendor fixes available. The September 2, 2025 release groups four items that affect a mix of engineering software, device-management utilities, and energy‑sector field devices—types of products that frequently sit at the intersection of corporate Windows infrastructure (HMIs, engineering workstations, monitoring servers) and field OT gear. The aggregated advisory page lists all four advisories and urges administrators to review the technical details for remediation. (cisa.gov)
The user-supplied material that prompted this article mirrors CISA’s release, and internal archive notes show similar advisories across CISA bulletins through 2025—demonstrating a sustained pattern of discovery and disclosure in ICS software and firmware.

---

Executive summary of the four advisories​

• Delta Electronics — EIP Builder (ICSA-25-245-01): an XML External Entity (XXE) information‑disclosure issue (CVE‑2025‑57704). CISA rates the CVSS v4 vector at 6.7 and identifies the vulnerability as exploitable via processing of crafted XML documents; Delta has released an update to V1.12 to remediate the issue. (cisa.gov, cvedetails.com)
• Fuji Electric — FRENIC‑Loader 4 (ICSA-25-245-02): a deserialization of untrusted data vulnerability (CVE‑2025‑9365) that CISA flags with a CVSS v4 8.4 and which could allow arbitrary code execution when an attacker convinces a user to import a malicious file. CISA lists affected versions (prior to 1.4.0.1) and recommends vendor updates. Third‑party indexing of this specific CVE was limited at the time of publication, so operators should rely on the official advisory and vendor channels for timely patches. (cisa.gov)
• SunPower — PVS6 (ICSA-25-245-03): use of hard‑coded credentials in the PVS6 servicing interface over Bluetooth Low Energy (CVE‑2025‑9696), with a CVSS v4 9.4 (critical). CISA warns that an attacker within Bluetooth range could gain full device access—enabling firmware replacement, grid‑setting changes, or disabling production. SunPower did not respond to CISA’s coordination attempts; CISA therefore lists mitigations and advises minimizing network exposure. Independent vulnerability trackers show matching CVE entries and similarly high severity scoring. (cisa.gov, tenable.com)
• Hitachi Energy — Relion 670/650 and SAM600‑IO Series (ICSA‑25‑182‑06, Update A): a resource allocation without limits/throttling vulnerability (CVE‑2025‑2403) that can be remotely exploitable to cause denial‑of‑service impacting critical functions (CISA lists CVSS v4 8.7). Hitachi’s PSIRT provides fixed firmware guidance and the CISA advisory notes updated fixed versions in the vendor PSIRT. NVD/CVE aggregators and vendor advisories corroborate the technical details and the fixed versions. (cisa.gov, nvd.nist.gov)

These advisories are not theoretical: they map to real-world device management and field-control functions that, if abused, can disrupt operations or give attackers persistent footholds into energy and manufacturing environments.

---

Detailed breakdown and technical verification​

Delta Electronics — EIP Builder (ICSA‑25‑245‑01)​

• What CISA says: EIP Builder versions 1.11 and prior are vulnerable to an XML External Entity (XXE) processing flaw that can disclose sensitive information. The vulnerability carries CVE‑2025‑57704, with a CVSS v4 base score of 6.7; Delta recommends updating to V1.12. CISA’s write‑up lists the attacker complexity as low for local exploitation (file parsing context). (cisa.gov)
• Independent verification: CVE aggregators reproduced the Delta advisory and scoring and list the same CVE number and CWE (CWE‑611). That independent feed confirms the details and provides an additional record of the vendor advisory PDF. Operators should treat CISA’s and the public CVE record as consistent and actionable. (cvedetails.com, nvd.nist.gov)
• Risk for defenders: XXE flaws often appear in engineering tools that parse project or configuration files. If EIP Builder runs on a Windows engineering workstation with network access to controllers, a tricked engineer opening a malicious file could leak credentials or files from the host, enabling lateral escalation. The fix—update to V1.12 and restrict where possible—is straightforward; the challenge is coordinating updates across engineering teams with long maintenance windows. (cisa.gov)

Fuji Electric — FRENIC‑Loader 4 (ICSA‑25‑245‑02)​

• What CISA says: FRENIC‑Loader 4 (versions prior to 1.4.0.1) is vulnerable to deserialization of untrusted data (CVE‑2025‑9365), which CISA assesses as allowing arbitrary code execution with a CVSS v4 8.4. The attack vector is local (user must import a crafted file) but has low complexity and high impact potential. (cisa.gov)
• Independent verification and caution: Fuji’s FRENIC tooling has a documented history of parsing vulnerabilities (multiple older CVEs and advisories exist), and third‑party security advisories historically tracked Fuji issues closely. However, at the time of this publication the specific CVE‑2025‑9365 had limited third‑party indexing beyond CISA’s advisory; some aggregators take time to import new entries. Where independent indexing is unavailable, CISA’s advisory and the vendor’s security bulletins are the authoritative sources. Operators should follow CISA’s mitigations and the vendor advisory for this item while treating any third‑party silence as a signal to exercise caution until vendor patch confirmation is obtained. (cisa.gov, zerodayinitiative.com)
• Risk for defenders: Deserialization flaws in loader utilities are classic RCE vectors when a user imports project files—an attacker who can social‑engineer an engineer into opening a crafted file could gain code execution on the workstation (often Windows), then move to deploy malicious payloads into OT management systems. Recommended controls include restricting who can open such files, scanning/upload sandboxing, and applying the vendor update. (cisa.gov)

SunPower — PVS6 (ICSA‑25‑245‑03)​

• What CISA says: The SunPower PVS6 device contains hard‑coded credentials and hard‑coded encryption parameters on its Bluetooth LE servicing interface. CISA assigns CVE‑2025‑9696 and a CVSS v4 9.4; successful exploitation from an adjacent network (Bluetooth range) could yield full device control, including firmware replacement and disabling production. SunPower reportedly did not respond to CISA’s coordination requests; CISA therefore recommends network segregation and minimizing exposure. (cisa.gov)
• Independent verification: Vulnerability trackers (commercial feeds) reproduce the CVE and the high severity rating, confirming CISA’s summary and impact characterization. The independent listings also show the CVSS v4 and v3 scoring aligned with CISA’s assessment. Because SunPower did not coordinate with CISA, the vendor’s remediation plan is not published in the advisory—operators must segregate and apply compensating controls immediately. (tenable.com)
• Risk for defenders: Hard‑coded credentials in field devices (especially energy gateways or inverter controllers) are among the most dangerous weaknesses: they may allow attackers physical‑proximity access to perform firmware modifications or create remote tunnels. For Windows administrators, the primary risk is indirect: compromised PVS6 devices could be used as staging points or to tamper with grid‑interface settings that lead to operational incidents. Immediate mitigations are to disable Bluetooth when feasible, move devices behind management VLANs and firewalls, and restrict servicing to authenticated, physical processes. (cisa.gov)

Hitachi Energy — Relion 670/650 and SAM600‑IO (ICSA‑25‑182‑06, Update A)​

• What CISA says: This advisory is an Update A to a prior Hitachi PSIRT advisory (initially published earlier); the issue is allocation of resources without throttling (CWE‑770) leading to denial‑of‑service (CVE‑2025‑2403). CISA rates the CVSS v4 score at 8.7 and lists specific affected firmware versions across Relion 650/670 and SAM600‑IO series, plus firmware versions that contain fixes. The update clarifies the fixed versions and recommends applying vendor‑supplied firmware updates. (cisa.gov)
• Independent verification: NVD and other vulnerability aggregators reflect the Hitachi advisory and the same CVE, severity, CWE categorization, and remediation guidance; the vendor PSIRT entry referenced by CISA provides the canonical fixed‑version guidance. This corroboration gives defenders confidence in the specifics and the recommended firmware targets for mitigation. (nvd.nist.gov, tenable.com)
• Risk for defenders: The most immediate threat is operational: a remote attacker able to trigger resource exhaustion on protection relays or communications modules can disrupt line distance communication and relay logic, impacting grid stability or tripping protection incorrectly. Hitachi’s published fixed firmware versions and CISA’s guidance are the remedy; operators must prioritize firmware upgrades during maintenance windows and ensure redundant protection and monitoring during the update cycle. (cisa.gov)

---

What this means for Windows administrators and IT/OT teams​

• Windows‑based engineering workstations and HMIs are frequently the bridge between IT and OT. Tools such as EIP Builder and FRENIC‑Loader typically run on Windows; a successful exploit on those tools gives an attacker a foothold in the corporate network and, through configuration, into control networks. Treat engineering workstations as high‑risk endpoints and apply the same rigorous patching, EDR, and endpoint hardening you’d use for servers. (cisa.gov)
• Network segmentation is not optional. Segregate device‑management endpoints from the business network, adopt strict firewall rules between IT and OT segments, and enforce jump‑server architectures for remote maintenance. CISA repeatedly emphasizes minimizing device exposure and isolating control networks; this is now standard best practice across advisories. (cisa.gov)
• Inventory and versioning matter. Many advisories specify exact affected firmware/software versions. An accurate asset inventory (including serials and firmware builds) is the only way to quickly identify affected units and prioritize updates—CISA and vendors will often reference exact builds that are fixed or remain vulnerable.
• Compensating controls for devices with slow patch cycles. For devices without immediate patches (or when vendor coordination failed, as with SunPower), implement mitigations:
• Disable or block unused interfaces (Bluetooth, USB, HTTP).
• Enforce least privilege for service accounts and maintenance tools.
• Restrict physical and wireless access to field devices.
• Implement allow‑lists on jump servers and use just‑in‑time access for maintenance windows. (cisa.gov)

---

Prioritization and remediation steps (actionable checklist)​

• Inventory: Identify all instances of Delta EIP Builder, Fuji FRENIC‑Loader 4, SunPower PVS6, and Hitachi Relion/SAM600‑IO in your environment and record software/firmware versions. Use vendor portals, asset management databases, and engineering records.
• Apply vendor fixes:
• Delta: update EIP Builder to V1.12 or later. (cisa.gov)
• Fuji: follow the FRENIC‑Loader 4 advisory and vendor updates; if a vendor patch is published, schedule immediate testing and rollout. Where the CVE is new, confirm vendor patch availability before wide deployment. (cisa.gov)
• SunPower: because SunPower did not co‑ordinate, treat this as high‑urgency for compensating controls (disable Bluetooth, isolate PVS6 units, limit servicing). If/when SunPower publishes a firmware, test and patch. (cisa.gov)
• Hitachi: apply the fixed firmware versions referenced in Hitachi’s PSIRT and CISA’s Update A (specific fixed versions are called out in the CISA advisory). Coordinate high‑availability maintenance windows before installs. (cisa.gov)
• Network controls:
• Block device management ports at the firewall unless explicitly required.
• Enforce VLAN segmentation and micro‑segmentation for OT devices.
• Use VPNs or secure remote access gateways with strong authentication for remote maintenance.
• Endpoint controls:
• Treat engineering workstations as critical endpoints: enable EDR, application allow‑listing, and least‑privilege policies.
• Scan incoming files and quarantine or sandbox engineering project files before opening in device utilities.
• Monitoring and detection:
• Add IDS/IPS signatures and behavioral alerts for unusual firmware‑flashing activity, configuration changes, or unexpected SSH tunnels.
• Use logging and SIEM correlation to detect lateral movement from engineering hosts into OT. (cisa.gov)
• Incident response readiness:
• Create playbooks that specifically address firmware compromise, relay denial‑of‑service, or manipulated inverter/grid settings.
• Maintain offline backups of critical configuration and signed firmware images when available.

---

Strengths and limitations of the advisories​

• Strengths
• Timely and detailed: CISA’s advisories provide concise technical descriptions, explicit affected version ranges, CVE identifiers, and CVSS scoring—making triage fast for security teams. Each advisory also points to vendor PSIRT notices or downloadable patches when available, which accelerates remediation. (cisa.gov)
• Actionable mitigations: CISA repeatedly includes network‑segmentation and exposure‑reduction guidance that operational teams can implement immediately—even before patches are deployed. (cisa.gov)
• Limitations and risks
• Vendor coordination gaps: SunPower’s advisory explicitly states the vendor did not respond to CISA’s coordination attempts. Where vendor coordination is missing, defenders must assume the vulnerability is disclosed without an available vendor fix—which forces reliance on compensating controls and increases operational burden. (cisa.gov)
• Slow third‑party indexing: Some CVEs (notably the Fuji advisory’s CVE in this release) may not yet appear across every public aggregator. Defenders should not wait for third‑party indexing—CISA and vendor advisories are authoritative. Where independent corroboration is missing, flag the claim as new and unindexed and prioritize direct vendor contact. (cisa.gov)
• Operational friction: ICS devices often require careful scheduling to update (safety, redundancy, certification). Even with clear fixes, patch cycles and testing windows can leave multi‑day or multi‑week exposure windows that attackers may try to exploit. (cisa.gov)

---

Critical analysis — why these advisories matter now​

• Convergence and attack surface growth: Industrial devices are no longer purely air‑gapped. The use of engineering PCs, remote maintenance access, cloud telemetry, and mobile servicing features (Bluetooth in SunPower’s case) increases the likelihood that a vulnerability in a vendor tool translates quickly to a broader compromise—or to kinetically impactful outcomes in the energy or manufacturing sectors. (cisa.gov)
• Adversary economics: Vulnerabilities with low attack complexity and adjacent‑network exploitation vectors (e.g., Bluetooth) substantially lower the bar for attackers. The SunPower PVS6 advisory demonstrates how even proximity-based mechanisms can have outsized risk, because a Bluetooth exploit can lead to firmware replacement or grid‑setting manipulation. Attackers are rational—if a device is vulnerable and provides control over physical systems, it becomes an attractive target. (cisa.gov)
• The patch‑and‑test gap: The Hitachi advisory (Update A) reinforces that even when vendor fixes exist, communication and version clarity matter. CISA’s Update A clarifies fixed versions—essential for correct patching—but operators still must coordinate maintenance and validate each update in test environments to avoid unintended outages. The real risk is a botched update that causes downtime during remediation. (cisa.gov)
• Supply‑chain and discovery patterns: The Delta advisory was reported by a researcher working with Trend Micro’s Zero Day Initiative and lists coordinated disclosure. Fuji’s advisory continues a longer pattern of deserialization and file‑parsing flaws in loader/editor utilities. These patterns show that engineering‑tool parsing logic is a recurring weak point and should be a focus of secure development, fuzzing, and file‑handling hardening. (cisa.gov, zerodayinitiative.com)

---

Practical recommendations for WindowsForum readers and infrastructure teams​

• Immediately inventory: Use endpoint management and asset tools (and the device management consoles) to list affected versions of the products named in CISA’s September 2 release. If you have any SunPower PVS6 units, treat them as high priority for network isolation and Bluetooth disabling.
• Prioritize patches by impact and exploitability: Start with devices where CISA marks remote exploitability and high CVSS (SunPower CVSS v4 9.4; Hitachi CVSS v4 8.7; Fuji CVSS v4 8.4) and those that sit at the IT/OT boundary. (cisa.gov)
• Harden engineering workstations (Windows):
• Enforce EDR and application‑allow listing.
• Use isolated, patched jump servers for all OT maintenance.
• Block common file‑sharing vectors (email attachments to engineering hosts) or sandbox files before opening in device editors. (cisa.gov)
• Threat hunting and monitoring:
• Look for anomalies: unexpected SSH connections, firmware‑write activity, unusual Bluetooth pairing events, or sudden configuration changes on inverters or relays.
• Correlate logs from OT gateways with SIEM timelines from Windows servers and jump hosts.
• Vendor engagement:
• Subscribe to vendor PSIRT lists and CISA ICS bulletins.
• If vendor coordination is absent (SunPower example), request a timeline and escalate within the vendor’s customer support and account teams until you receive a tested remediation plan. (cisa.gov)

---

Final assessment and closing thoughts​

CISA’s September 2, 2025 release of four ICS advisories underscores a persistent security reality: attackers exploit the weakest link in heterogeneous environments, and that link is often software that parses complex, engineer‑authored files or exposes maintenance interfaces without sufficient authentication. The Delta and Fuji advisories reaffirm that file‑parsing and deserialization vulnerabilities remain prevalent in loader/editor utilities; the SunPower advisory demonstrates the outsized consequences of embedded hard‑coded credentials in energy devices; and the Hitachi Update A shows the importance of vendor patch clarity and version control in the energy sector. (cisa.gov)
Action is clear and immediate: inventory affected devices, apply vendor fixes where available, implement compensating network and endpoint controls where patches are not yet possible, and treat engineering workstations as part of the critical‑asset estate. Where vendor coordination is incomplete, assume the worst and harden perimeter and access controls until a vendor‑tested firmware is available. The integrated IT/OT world rewards those who act early—delays will only increase risk and operational exposure.
For Windows‑centric administrators, the practical truth is this: ICS advisories are not “someone else’s problem.” Engineering tools run on Windows, management servers often sit in corporate datacenters, and successful exploitation of ICS software can quickly translate into enterprise incidents. CISA’s advisories are concise, actionable, and authoritative; use them as the foundation for triage, and apply the practical steps outlined here to reduce exposure now. (cisa.gov)

---

Conclusion: Treat this advisory set as high‑priority operational risk. Patch what you can, isolate and monitor what you can’t, and validate that engineering and OT teams understand the near‑term mitigations and the longer‑term plan to keep firmware and management tools current. The adversary landscape in 2025 remains active and opportunistic—defenders must be relentless and procedural in response.

---

Source: CISA CISA Releases Four Industrial Control Systems Advisories | CISA