Critical ICS Vulnerabilities Unveiled: Industry Giants Face Active Threats in 2025

Critical vulnerabilities in industrial control systems (ICS) frequently make headlines, but seldom do so many high-profile advisories appear at once. The Cybersecurity and Infrastructure Security Agency (CISA) has released six new ICS advisories, underscoring the ongoing and ever-evolving risks faced by critical infrastructure operators worldwide. These advisories, published on July 15, 2025, provide an in-depth look into the vulnerabilities detected within products from industry giants such as Hitachi Energy, ABB, LITEON, and Schneider Electric. This comprehensive analysis will unravel what each advisory signifies, assess the potential impact on operational technology (OT), and explore the strengths and shortcomings revealed both in vendor responses and in the broader ecosystem’s approach to ICS security.

Understanding the New ICS Advisories​

CISA’s advisories serve as an essential resource for OT environments, providing technical specifics about exploited vulnerabilities, affected products, and recommended mitigations. The six advisories released include:

• Hitachi Energy Asset Suite (ICSA-25-196-01)
• ABB RMC-100 (ICSA-25-196-02)
• LITEON IC48A and IC80A EV Chargers (ICSA-25-196-03)
• Schneider Electric EcoStruxure (Update B) (ICSA-25-037-02)
• Schneider Electric Modicon Controllers (Update A) (ICSA-25-140-08)
• Schneider Electric Uni-Telway Driver (Update A) (ICSA-25-070-01)

Each addresses different facets of the industrial digital ecosystem, from power management to emerging electric vehicle infrastructure and long-trusted programmable logic controllers (PLCs). With the continued convergence of IT and OT environments, the risks associated with ICS vulnerabilities have never been more pressing.

---

Hitachi Energy Asset Suite: Configuration Risks in Critical Energy Systems​

CISA Advisory: ICSA-25-196-01

Vulnerability Overview​

The Hitachi Energy Asset Suite, employed by major utilities worldwide, manages core asset and work management functions in energy and water sectors. According to CISA’s advisory, multiple vulnerabilities have been identified in this software suite. Attackers could exploit these to gain privileged access, manipulate configuration files, or disrupt operations entirely. While exact technical details remain under wraps to prevent exploitation ahead of patch deployment, prior advisories for Asset Suite products often reference improper access controls and insufficient input validation.

Impact Analysis​

Given the criticality of Asset Suite to grid operations, risks include unauthorized asset manipulations, interruption of workflow management, and potentially, cascading effects on power distribution. Notably, similar past vulnerabilities have enabled attackers to escalate privileges and persist within victims’ environments even after detected. Although Hitachi Energy has historically responded with patches and rapid advisories, the window between disclosure and patch application constitutes a point of vulnerability, demanding urgency from customers.

Vendor Response and Recommendations​

Hitachi Energy has issued mitigation guidance, including software updates and configuration best practices to minimize exposure. CISA urges strict access control implementations, regular software updating, and network segmentation to reduce attack surfaces. However, in production OT networks, patching delays and legacy systems may hinder immediate remediation—a recurring pain point in industrial cybersecurity.

---

ABB RMC-100: Railways at a Crossroads​

CISA Advisory: ICSA-25-196-02

Vulnerability Overview​

ABB’s RMC-100 is an integral communications controller for railway and industrial automation networks. The newly disclosed vulnerability reportedly exposes the system to remote code execution or denial-of-service conditions via manipulated network packets. This aligns with trends observed in ICS vulnerabilities where exposed network interfaces, often legacy and unencrypted, provide an attack vector for skilled adversaries.

Potential Impact​

An attacker exploiting this flaw could halt railway automation processes, override safety controls, or disable critical fail-safes. Considering the widespread deployment of ABB’s RMC-100, notably in Europe and Asia, the systemic risk is significant. Breaches in railway signaling and control infrastructure could, in extreme cases, lead to safety incidents and widespread service disruption.

ABB's Mitigation Efforts​

ABB recommends immediate application of security patches, disabling unnecessary network services, and leveraging network firewalls to limit exposure. However, as with many industrial controllers, systems can be in continuous operation and updates may require service outages, making practical mitigation a substantial challenge for operators.

---

LITEON EV Chargers: The Perimeter Weakness in Smart Mobility​

CISA Advisory: ICSA-25-196-03

Flaws in the Fast-Growing EV Infrastructure​

Two models, the LITEON IC48A and IC80A EV chargers, have been identified with vulnerabilities enabling remote attackers to manipulate charging sessions, access sensitive configuration data, or cause charger shutdowns. With electric vehicles quickly becoming mainstays on global roads, and public charging stations proliferating, these weaknesses highlight a critical blind spot in smart city planning.

Broader Implications​

Beyond inconvenience for EV owners, compromised charging stations may pose national-level grid threats if exploited en masse. Large-scale attacks could overload substations or provide pivot points for further attacks into critical infrastructure networks. The attack vector also raises privacy questions, as EV chargers often log user, vehicle, and transactional data.

LITEON’s Remediation Steps​

The vendor has issued firmware updates and strongly recommends that operators avoid connecting chargers directly to public-facing networks. Nonetheless, a significant proportion of public EV infrastructure operates on third-party-managed networks, highlighting a complex web of responsibility among stakeholders and underscoring the need for coordinated cybersecurity standards in the transport sector.

---

Schneider Electric: A Trio of Advisories for OT Mainstays​

Schneider Electric, a ubiquitous name in OT, is referenced in three of the six advisories. The affected products—EcoStruxure suite, Modicon controllers, and the Uni-Telway driver—span a vast range of industrial applications.

EcoStruxure (Update B): Persistent Vulnerabilities in IoT-OT Synergy​

CISA Advisory: ICSA-25-037-02
EcoStruxure’s architecture unites IoT sensors, advanced analytics, and industrial controls. The new advisory highlights vulnerabilities that could permit attackers to issue unauthorized commands or siphon sensitive operational data. This points toward a growing class of threats: supply chain and lateral attacks, as interlinked OT networks multiply the blast radius of any single vulnerability.

Strengths and Weaknesses​

• Strengths: Schneider’s continued transparency and ongoing patching cadence are commendable, providing timely updates and practical compensating controls during patch rollouts.
• Weaknesses: The growing complexity of EcoStruxure deployments means security teams often lag behind attackers in testing and deploying fixes. Interoperability across legacy and modern components amplifies this challenge.

Modicon Controllers (Update A): The Backbone of Automated Industry​

CISA Advisory: ICSA-25-140-08
Modicon PLCs administer everything from water treatment plants to manufacturing lines. Recent vulnerabilities again expose them to remote code execution (RCE) and unauthorized access. These flaws underscore longstanding issues with ICS device design decisions—such as unencrypted communications and hardcoded credentials—that persist due to prioritization of availability over security.

Threat Scenarios​

Should adversaries exploit these weaknesses, malicious code could be loaded undetected, process parameters could be altered, or entire manufacturing lines brought offline. Notably, prior attacks such as the infamous Triton/Trisis incident leveraged similar PLC vulnerabilities to devastating effect.

Uni-Telway Driver (Update A): Legacy Technology, Modern Threats​

CISA Advisory: ICSA-25-070-01
The Uni-Telway protocol, developed in the 1980s, remains present in many legacy OT environments. Modern threat actors are now weaponizing protocol weaknesses that were never envisioned in an era of physical air gaps. The recent advisory highlights flaws allowing data interception and parameter manipulation, threats magnified by present-day remote maintenance practices.

Cautionary Note​

While Schneider Electric’s guidance advises system isolation and manual mitigation for legacy systems, the cost and complexity of replacing or updating such entrenched technologies pose ongoing operational difficulties.

---

Critical Analysis: Strengths and Systemic Shortcomings​

Notable Strengths​

1. Transparent Disclosure Practices: The quick publication of detailed advisories by CISA and affected vendors demonstrates a maturing approach to vulnerability management.
2. Coordinated Response: Vendors have provided clear, actionable remediation steps. For newer platforms, regular firmware and software updates are readily available, and there are guidance materials for mitigation where patches are unfeasible.
3. Growing Sector Awareness: Inclusion of EV chargers and IoT-rich solutions such as EcoStruxure in advisories signals a widening recognition of non-traditional ICS risk.

Persistent Risks and Weaknesses​

• Legacy Burden: Many threats persist due to the slow replacement of decades-old infrastructure. Interdependencies between old and new tech complicate upgrade cycles and risk assessments.
• Patch Management Constraints: ICS environments value availability above all; lengthy test and deployment cycles for patches impede timely defenses.
• Complex Vendor Ecosystem: Multiple stakeholders (vendors, operators, third-party managers) often lead to ambiguities in patch responsibility and incident response.
• Increased Attack Surface: Expanded remote access, IoT integration, and cloud connectivity—especially post-pandemic—heighten risks, particularly when default configurations are not sufficiently hardened.
• Supply Chain Exposure: Compromises in one product or protocol (e.g., a vulnerable EV charger on a semi-isolated network) can be leveraged against critical backend systems in the same environment.

---

Recommendations for Operators and Administrators​

Given the highlighted vulnerabilities and the unique constraints of OT environments, robust cybersecurity postures should include:

Immediate Steps​

• Inventory and Segmentation: Identify all assets affected by these advisories and ensure network segmentation between IT and OT.
• Patch and Update: Prioritize patching where vendor updates exist. For legacy equipment, implement compensating controls.
• Restrict Access: Limit both logical (remote admin interfaces, unused services) and physical access to sensitive devices.
• Monitor and Alert: Deploy anomaly detection solutions tailored for ICS protocols, and ensure logging is comprehensive and secure.
• Regular Audits: Conduct vulnerability assessments and penetration testing, focusing on both modern and legacy systems.

Long-Term Strategies​

• Sunset Legacy Tech: Develop phased plans for the retirement of legacy protocols and devices wherever feasible.
• Zero Trust Architectures: Adopt principles that expect breach, requiring authentication and monitoring for every system interaction.
• Incident Response Exercises: Simulate ICS-specific attack scenarios and ensure cross-stakeholder collaboration for swift remediation.

---

A Wake-Up Call for Critical Infrastructure Security​

The release of these six CISA advisories paints a clear, if daunting, picture: the convergence of digital transformation and aging industrial assets continues to create fertile ground for advanced threats. While positive strides are being made in transparency, patch development, and awareness, the complexity and inertia embedded in critical infrastructure present enduring challenges. Operators, vendors, and regulators must move beyond reactive measures toward proactive, systemic reform—balancing safety, productivity, and security in an increasingly interconnected world.
The time for complacency in ICS security is decidedly over. Whether in energy grids, railway systems, smart transportation, or the manufacturing floor, diligent application of security best practices—backed by cross-sector cooperation and future-focused investment—remains paramount. As these advisories demonstrate, securing the world’s industrial lifeblood is the shared responsibility of all digital society’s stakeholders.

---

Source: CISA CISA Releases Six Industrial Control Systems Advisories | CISA