August 2025
07.08.2025
US CERT (ICS)
Yealink IP Phones and RPS (Redirect and Provisioning Service)
Title
Yealink IP Phones and RPS (Redirect and Provisioning Service)
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-08
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Yealink Equipment: IP Phones Vulnerability: Improper Restriction of Excessive Authentication Attempts, Allocation of Resources Without Limits or Throttling, Incorrect Authorization, Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an information ...
07.08.2025
US CERT (ICS)
Delta Electronics DIAView
Title
Delta Electronics DIAView
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: DIAView Vulnerability: Improper Limitation of a Pathname to a Restricted Directory 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a remote attacker to read or write files on the affected device. ...
07.08.2025
US CERT (ICS)
Dreame Technology iOS and Android Mobile Applications
Title
Dreame Technology iOS and Android Mobile Applications
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Dreame Technology Equipment: Dreamehome and MOVAhome mobile applications Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized information disclosure. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of the ...
07.08.2025
US CERT (ICS)
EG4 Electronics EG4 Inverters
Title
EG4 Electronics EG4 Inverters
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: EG4 Electronics Equipment: EG4 Inverters Vulnerabilities: Cleartext Transmission of Sensitive Information, Download of Code Without Integrity Check, Observable Discrepancy, Improper Restriction of Excessive Authentication Attempts 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
07.08.2025
US CERT (ICS)
Packet Power EMX and EG
Title
Packet Power EMX and EG
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Packet Power Equipment: EMX, EG Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full access to the device without authentication. 3. TECHNICAL DETAILS 3.1 ...
07.08.2025
US CERT (ICS)
Johnson Controls FX80 and FX90
Title
Johnson Controls FX80 and FX90
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: FX80 and FX90 Vulnerability: Dependency on Vulnerable Third-Party Component 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to compromise the device's configuration files. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
07.08.2025
US CERT (ICS)
Burk Technology ARC Solo
Title
Burk Technology ARC Solo
Published
Aug. 7, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Burk Technology Equipment: ARC Solo Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker gaining access to the device, locking out authorized users, or disrupting operations. ...
05.08.2025
US CERT (ICS)
Mitsubishi Electric Iconics Digital Solutions Multiple Products
Title
Mitsubishi Electric Iconics Digital Solutions Multiple Products
Published
Aug. 5, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 4.1 ATTENTION: Low attack complexity Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64 Vulnerability: Windows Shortcut Following (.LNK) 2. RISK EVALUATION Successful exploitation of this vulnerability could result in information tampering. 3. TECHNICAL DETAILS ...
05.08.2025
US CERT (ICS)
Tigo Energy Cloud Connect Advanced
Title
Tigo Energy Cloud Connect Advanced
Published
Aug. 5, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Tigo Energy Equipment: Cloud Connect Advanced Vulnerabilities: Use of Hard-coded Credentials, Command Injection, Predictable Seed in Pseudo-Random Number Generator (PRNG). 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative access ...
July 2025
31.07.2025
US CERT (ICS)
Güralp Systems Güralp FMUS series
Title
Güralp Systems Güralp FMUS series
Published
July 31, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Güralp Systems Equipment: Güralp FMUS Series Seismic Monitoring Devices Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset ...
29.07.2025
US CERT (ICS)
Samsung HVAC DMS
Title
Samsung HVAC DMS
Published
July 29, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.5 ATTENTION: Exploitable remotely Vendor: Samsung Equipment: HVAC DMS Vulnerabilities: Execution After Redirect (EAR), Deserialization of Untrusted Data, Absolute Path Traversal, Use of Potentially Dangerous Function, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal 2. RISK EVALUATION ...
24.07.2025
US CERT (ICS)
Honeywell Experion PKS
Title
Honeywell Experion PKS
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion PKS Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong ...
24.07.2025
US CERT (ICS)
Network Thermostat X-Series WiFi Thermostats
Title
Network Thermostat X-Series WiFi Thermostats
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Network Thermostat Equipment: X-Series WiFi thermostats Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device. 3. TECHNICAL DETAILS 3.1 ...
24.07.2025
US CERT (ICS)
LG Innotek Camera Model LNV5110R
Title
LG Innotek Camera Model LNV5110R
Published
July 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.3 ATTENTION: Exploitable remotely Vendor: LG Innotek Equipment: Camera Model LNV5110R Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain administrative access to the device. 3. TECHNICAL DETAILS 3.1 ...
22.07.2025
US CERT (ICS)
Lantronix Provisioning Manager
Title
Lantronix Provisioning Manager
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Low attack complexity Vendor: Lantronix Equipment: Provisioning Manager Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a cross-site scripting attack, which could result in remote code execution. ...
22.07.2025
US CERT (ICS)
Schneider Electric System Monitor Application
Title
Schneider Electric System Monitor Application
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.9 ATTENTION: Exploitable remotely Vendor: Schneider Electric Equipment: System Monitor Application Vulnerability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute untrusted code. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
22.07.2025
US CERT (ICS)
Schneider Electric EcoStruxture IT Data Center Expert
Title
Schneider Electric EcoStruxture IT Data Center Expert
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure IT Data Center Expert Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Insufficient Entropy, Improper Control of Generation of Code ('Code Injection'), Server-Side Request Forgery (SSRF), ...
22.07.2025
US CERT (ICS)
Schneider Electric EcoStruxure Power Operation
Title
Schneider Electric EcoStruxure Power Operation
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: Schneider Electric Equipment: EcoStruxure Power Operation Vulnerabilities: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), Integer Overflow to Buffer Overflow, Improper Handling of Highly Compressed Data (Data Amplification), Out-of-bounds ...
22.07.2025
US CERT (ICS)
DuraComm DP-10iN-100-MU
Title
DuraComm DP-10iN-100-MU
Published
July 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: DuraComm Corporation Equipment: SPM-500 DP-10iN-100-MU Vulnerabilities: Cleartext Transmission of Sensitive Information, Missing Authentication for a Critical Function, Improper Neutralization of Input During Web Page Generation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
17.07.2025
US CERT (ICS)
Leviton AcquiSuite and Energy Monitoring Hub
Title
Leviton AcquiSuite and Energy Monitoring Hub
Published
July 17, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Leviton Equipment: AcquiSuite, Energy Monitoring Hub Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to craft a malicious payload in URL parameters that would execute in a client browser ...
15.07.2025
US CERT (ICS)
Hitachi Energy Asset Suite
Title
Hitachi Energy Asset Suite
Published
July 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Energy Asset Suite Vulnerabilities: Incomplete List of Disallowed Inputs, Plaintext Storage of a Password, Out-of-bounds Write, Release of Invalid Pointer or Reference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
15.07.2025
US CERT (ICS)
LITEON IC48A and IC80A EV Chargers
Title
LITEON IC48A and IC80A EV Chargers
Published
July 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: LITEON Equipment: IC48A and IC80A Vulnerability: Plaintext Storage of a Password 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access sensitive information when accessing the Liteon EV chargers. 3. TECHNICAL DETAILS ...
10.07.2025
US CERT (ICS)
Siemens TIA Project-Server and TIA Portal
Title
Siemens TIA Project-Server and TIA Portal
Published
July 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-05
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
10.07.2025
US CERT (ICS)
KUNBUS RevPi Webstatus
Title
KUNBUS RevPi Webstatus
Published
July 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-09
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: KUNBUS Equipment: RevPi Webstatus Vulnerability: Incorrect Implementation of Authentication Algorithm 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to bypass authentication and gain unauthorized access to the application. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
10.07.2025
US CERT (ICS)
End-of-Train and Head-of-Train Remote Linking Protocol
Title
End-of-Train and Head-of-Train Remote Linking Protocol
Published
July 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-10
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.2 ATTENTION: Low attack complexity Standard: End-of-Train and Head-of-Train remote linking protocol Equipment: End-of-Train and Head-of-Train devices Vulnerability: Weak Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send their own brake control commands to the end-of-train device, ...

Last Updates

BOSCH PSIRT
10.06.2025
SIEMENS CERT
21.07.2025
US CERT
29.07.2025
US CERT (ICS)
07.08.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds