April 2025
24.04.2025
US CERT (ICS)
Johnson Controls ICU
Title
Johnson Controls ICU
Published
April 24, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: ICU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls reports the following ...
22.04.2025
US CERT (ICS)
Siemens TeleControl Server Basic
Title
Siemens TeleControl Server Basic
Published
April 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
22.04.2025
US CERT (ICS)
Schneider Electric Wiser Home Controller WHC-5918A
Title
Schneider Electric Wiser Home Controller WHC-5918A
Published
April 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Wiser Home Controller WHC-5918A Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose sensitive credentials. 3. TECHNICAL DETAILS 3.1 ...
22.04.2025
US CERT (ICS)
ABB MV Drives
Title
ABB MV Drives
Published
April 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: MV Drives Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain full ...
22.04.2025
US CERT (ICS)
Siemens TeleControl Server Basic SQL
Title
Siemens TeleControl Server Basic SQL
Published
April 22, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
17.04.2025
US CERT (ICS)
Schneider Electric Trio Q Licensed Data Radio
Title
Schneider Electric Trio Q Licensed Data Radio
Published
April 17, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.4 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Trio Q Licensed Data Radio Vulnerabilities: Insecure Storage of Sensitive Information, Initialization of a Resource with an Insecure Default 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access confidential ...
17.04.2025
US CERT (ICS)
Schneider Electric Sage Series
Title
Schneider Electric Sage Series
Published
April 17, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Sage series Vulnerabilities: Out-of-bounds Write, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Default Permissions, Unchecked Return Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds ...
17.04.2025
US CERT (ICS)
Schneider Electric ConneXium Network Manager
Title
Schneider Electric ConneXium Network Manager
Published
April 17, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: ConneXium Network Manager Vulnerabilities: Files or Directories Accessible to External Parties, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive data, escalate privileges, or ...
17.04.2025
US CERT (ICS)
Yokogawa Recorder Products
Title
Yokogawa Recorder Products
Published
April 17, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: GX10, GX20, GP10, GP20, GM Data Acquisition System, DX1000, DX2000, DX1000N, FX1000, μR10000, μR20000, MW100, DX1000T, DX2000T, CX1000, CX2000 Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could ...
15.04.2025
US CERT (ICS)
Lantronix Xport
Title
Lantronix Xport
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: Xport Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...
15.04.2025
US CERT (ICS)
Growatt Cloud Applications
Title
Growatt Cloud Applications
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Growatt Equipment: Cloud Applications Vulnerabilities: Cross-site Scripting, Authorization Bypass Through User-Controlled Key, Insufficient Type Distinction, External Control of System or Configuration Setting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to compromise ...
15.04.2025
US CERT (ICS)
Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX
Title
Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
15.04.2025
US CERT (ICS)
Mitsubishi Electric Europe B.V. smartRTU
Title
Mitsubishi Electric Europe B.V. smartRTU
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Europe B.V. Equipment: smartRTU Vulnerability: Missing Authentication for Critical Function, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete ...
15.04.2025
US CERT (ICS)
ABB M2M Gateway
Title
ABB M2M Gateway
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: M2M Gateway Vulnerabilities: Integer Overflow or Wraparound, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Unquoted Search Path or Element, Untrusted Search Path, Use After Free, Out-of-bounds Write, Buffer Copy without Checking Size of ...
15.04.2025
US CERT (ICS)
Siemens Industrial Edge Device Kit
Title
Siemens Industrial Edge Device Kit
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
15.04.2025
US CERT (ICS)
Delta Electronics COMMGR
Title
Delta Electronics COMMGR
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-07
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: COMMGR Vulnerability: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for an attacker to remotely access the AS3000Simulator family in the COMMGR software ...
15.04.2025
US CERT (ICS)
Lantronix Xport (Update A)
Title
Lantronix Xport (Update A)
Published
April 15, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: XPort Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...
10.04.2025
US CERT (ICS)
Siemens Insights Hub Private Cloud
Title
Siemens Insights Hub Private Cloud
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-05
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
10.04.2025
US CERT (ICS)
Siemens Industrial Edge Devices
Title
Siemens Industrial Edge Devices
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-04
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
10.04.2025
US CERT (ICS)
Siemens SIDIS Prime
Title
Siemens SIDIS Prime
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
10.04.2025
US CERT (ICS)
Siemens License Server
Title
Siemens License Server
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-01
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
10.04.2025
US CERT (ICS)
ABB Arctic Wireless Gateways
Title
ABB Arctic Wireless Gateways
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-09
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: Arctic Wireless Gateways Vulnerabilities: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Privilege Management, Exposure of Sensitive Information to an Unauthorized Actor, Improper Limitation of a Pathname to a Restricted Directory ...
10.04.2025
US CERT (ICS)
Siemens SENTRON 7KT PAC1260 Data Manager
Title
Siemens SENTRON 7KT PAC1260 Data Manager
Published
April 10, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-06
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
03.04.2025
US CERT (ICS)
Hitachi Energy RTU500 Series
Title
Hitachi Energy RTU500 Series
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 series Vulnerabilities: Null Pointer Dereference, Insufficient Resource Pool, Missing Synchronization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
03.04.2025
US CERT (ICS)
Hitachi Energy TRMTracker
Title
Hitachi Energy TRMTracker
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TRMTracker Vulnerabilities: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'), Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Neutralization of Input During Web ...

Last Updates

BOSCH PSIRT
25.04.2025
SIEMENS CERT
14.05.2025
US CERT
01.04.2025
US CERT (ICS)
15.05.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds