August 2025
12.08.2025
SIEMENS CERT
SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...
Title
SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1
Published
Aug. 12, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
12.08.2025
SIEMENS CERT
SSA-687955 V1.1 (Last Update: 2025-08-12): Accessible Development Shell via Physical Interface in SIPROTEC 5
Title
SSA-687955 V1.1 (Last Update: 2025-08-12): Accessible Development Shell via Physical Interface in SIPROTEC 5
Published
Aug. 12, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-687955.html
Summary
Affected SIPROTEC 5 devices contain a development shell which is accessible via a physical interface which is not properly restricted. This could allow an unauthenticated attacker with physical access to an affected device to execute arbitrary commands on the device. Siemens has released new versions for several affected products and ...
07.08.2025
US CERT (ICS)
Delta Electronics DIAView
Title
Delta Electronics DIAView
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: DIAView Vulnerability: Improper Limitation of a Pathname to a Restricted Directory 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a remote attacker to read or write files on the affected device. ...
07.08.2025
US CERT (ICS)
Burk Technology ARC Solo
Title
Burk Technology ARC Solo
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Burk Technology Equipment: ARC Solo Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker gaining access to the device, locking out authorized users, or disrupting operations. ...
07.08.2025
US CERT (ICS)
Johnson Controls FX80 and FX90
Title
Johnson Controls FX80 and FX90
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: FX80 and FX90 Vulnerability: Dependency on Vulnerable Third-Party Component 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to compromise the device's configuration files. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
07.08.2025
US CERT (ICS)
Yealink IP Phones and RPS (Redirect and Provisioning Service)
Title
Yealink IP Phones and RPS (Redirect and Provisioning Service)
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-08
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Yealink Equipment: IP Phones Vulnerability: Improper Restriction of Excessive Authentication Attempts, Allocation of Resources Without Limits or Throttling, Incorrect Authorization, Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an information ...
07.08.2025
US CERT (ICS)
EG4 Electronics EG4 Inverters
Title
EG4 Electronics EG4 Inverters
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: EG4 Electronics Equipment: EG4 Inverters Vulnerabilities: Cleartext Transmission of Sensitive Information, Download of Code Without Integrity Check, Observable Discrepancy, Improper Restriction of Excessive Authentication Attempts 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
07.08.2025
US CERT (ICS)
Dreame Technology iOS and Android Mobile Applications
Title
Dreame Technology iOS and Android Mobile Applications
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Dreame Technology Equipment: Dreamehome and MOVAhome mobile applications Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized information disclosure. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of the ...
07.08.2025
US CERT (ICS)
Packet Power EMX and EG
Title
Packet Power EMX and EG
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Packet Power Equipment: EMX, EG Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full access to the device without authentication. 3. TECHNICAL DETAILS 3.1 ...
05.08.2025
US CERT (ICS)
Mitsubishi Electric Iconics Digital Solutions Multiple Products
Title
Mitsubishi Electric Iconics Digital Solutions Multiple Products
Published
Aug. 5, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 4.1 ATTENTION: Low attack complexity Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64 Vulnerability: Windows Shortcut Following (.LNK) 2. RISK EVALUATION Successful exploitation of this vulnerability could result in information tampering. 3. TECHNICAL DETAILS ...
05.08.2025
US CERT (ICS)
Tigo Energy Cloud Connect Advanced
Title
Tigo Energy Cloud Connect Advanced
Published
Aug. 5, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Tigo Energy Equipment: Cloud Connect Advanced Vulnerabilities: Use of Hard-coded Credentials, Command Injection, Predictable Seed in Pseudo-Random Number Generator (PRNG). 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative access ...
July 2025
31.07.2025
US CERT (ICS)
Güralp Systems Güralp FMUS series
Title
Güralp Systems Güralp FMUS series
Published
July 31, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Güralp Systems Equipment: Güralp FMUS Series Seismic Monitoring Devices Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset ...
31.07.2025
US CERT (ICS)
Güralp Systems FMUS Series and MIN Series Devices (Update A)
Title
Güralp Systems FMUS Series and MIN Series Devices (Update A)
Published
July 31, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Güralp Systems Equipment: Güralp FMUS Series and MIN Series Devices Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory ...
29.07.2025
US CERT
CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at US Critical Infrastructure...
Title
CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at US Critical Infrastructure Organization
Published
July 29, 2025, 7:53 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-212a
Summary
Summary The Cybersecurity and Infrastructure Security Agency (CISA) and U.S. Coast Guard (USCG) are issuing this Cybersecurity Advisory to present findings from a recent CISA and USCG hunt engagement. The purpose of this advisory is to highlight identified cybersecurity issues, thereby informing security defenders in other organizations of potential similar ...
29.07.2025
US CERT (ICS)
Samsung HVAC DMS
Title
Samsung HVAC DMS
Published
July 29, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.5 ATTENTION: Exploitable remotely Vendor: Samsung Equipment: HVAC DMS Vulnerabilities: Execution After Redirect (EAR), Deserialization of Untrusted Data, Absolute Path Traversal, Use of Potentially Dangerous Function, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal 2. RISK EVALUATION ...
24.07.2025
US CERT (ICS)
Honeywell Experion PKS
Title
Honeywell Experion PKS
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion PKS Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong ...
24.07.2025
US CERT (ICS)
Network Thermostat X-Series WiFi Thermostats
Title
Network Thermostat X-Series WiFi Thermostats
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Network Thermostat Equipment: X-Series WiFi thermostats Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device. 3. TECHNICAL DETAILS 3.1 ...
24.07.2025
US CERT (ICS)
LG Innotek Camera Model LNV5110R
Title
LG Innotek Camera Model LNV5110R
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.3 ATTENTION: Exploitable remotely Vendor: LG Innotek Equipment: Camera Model LNV5110R Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain administrative access to the device. 3. TECHNICAL DETAILS 3.1 ...
22.07.2025
US CERT (ICS)
Schneider Electric EcoStruxture IT Data Center Expert
Title
Schneider Electric EcoStruxture IT Data Center Expert
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure IT Data Center Expert Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Insufficient Entropy, Improper Control of Generation of Code ('Code Injection'), Server-Side Request Forgery (SSRF), ...
22.07.2025
US CERT (ICS)
DuraComm DP-10iN-100-MU
Title
DuraComm DP-10iN-100-MU
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: DuraComm Corporation Equipment: SPM-500 DP-10iN-100-MU Vulnerabilities: Cleartext Transmission of Sensitive Information, Missing Authentication for a Critical Function, Improper Neutralization of Input During Web Page Generation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
22.07.2025
US CERT (ICS)
Schneider Electric EcoStruxure Power Operation
Title
Schneider Electric EcoStruxure Power Operation
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: Schneider Electric Equipment: EcoStruxure Power Operation Vulnerabilities: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), Integer Overflow to Buffer Overflow, Improper Handling of Highly Compressed Data (Data Amplification), Out-of-bounds ...
22.07.2025
US CERT (ICS)
Schneider Electric System Monitor Application
Title
Schneider Electric System Monitor Application
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.9 ATTENTION: Exploitable remotely Vendor: Schneider Electric Equipment: System Monitor Application Vulnerability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute untrusted code. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
22.07.2025
US CERT (ICS)
Lantronix Provisioning Manager
Title
Lantronix Provisioning Manager
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Low attack complexity Vendor: Lantronix Equipment: Provisioning Manager Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a cross-site scripting attack, which could result in remote code execution. ...
21.07.2025
US CERT
#StopRansomware: Interlock
Title
#StopRansomware: Interlock
Published
July 21, 2025, 4:11 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
Summary
Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect ...
21.07.2025
SIEMENS CERT
SSA-725549 V1.3 (Last Update: 2025-07-21): Denial of Service of ICMP in Industrial Devices
Title
SSA-725549 V1.3 (Last Update: 2025-07-21): Denial of Service of ICMP in Industrial Devices
Published
July 21, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-725549.html
Summary
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The integrated ICMP services in the underlying TCP/IP stack is vulnerable to a denial of service attack through specially crafted ICMP packets. A successful attack will impact the availability ...

Last Updates

BOSCH PSIRT
14.08.2025
SIEMENS CERT
19.08.2025
US CERT
29.07.2025
US CERT (ICS)
21.08.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds