CISA Advisories

The Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) have released an initial draft of Interagency Report (IR) 8597 Protecting Tokens and Assertions from Forgery, Theft, and Misuse for public comment through January 30, 2026. This report is in response to Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144, providing implementation guidance to help federal agencies and cloud service providers (CSPs) protect identity tokens and assertions from forgery, theft, and misuse. Recent cybersecurity incidents at major cloud service providers have focused on stealing, modifying, or forging identity tokens and assertions to gain access to protected resources. This report covers the controls for identity access management (IAM) systems that rely on digitally signed assertions and tokens when making access decisions. It discusses how CSPs and cloud consumers, including government agencies, can better define their respective roles and responsibilities for managing IAM controls in cloud environments. It establishes principles for both CSPs and cloud consumers, calling on CSPs to apply Secure by Design best practices, and to prioritize transparency, configurability, and interoperability, empowering consumers to better defend their diverse environments. It also calls upon federal agencies to understand the architecture and deployment models of their procured CSPs to ensure proper alignment with risk posture and threat environment. Comments on the report may be submitted to iam@list.nist.gov. Please visit NIST’s site for more information.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2023-52163 Digiever DS-2105 Pro Missing Authorization Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Today, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency, and Canadian Centre for Cyber Security released an update to the Malware Analysis Report BRICKSTORM Backdoor with indicators of compromise (IOCs) and detection signatures for additional BRICKSTORM samples. This update provides information on additional samples, including Rust-based samples. These samples demonstrate advanced persistence and defense evasion mechanisms, such as running as background services, and enhanced command and control capabilities through encrypted WebSocket connections. The update includes two new detection signatures in the form of YARA rules, enabling organizations to better identify BRICKSTORM-related activity. Organizations are strongly encouraged to deploy these updated IOCs and signatures, and to follow the detection guidance to scan for and respond to BRICKSTORM infections If BRICKSTORM, similar malware, or potentially related activity is detected, report the incident to CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or (888) 282-0870.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14733 WatchGuard Firebox Out-of-Bounds Write Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

View CSAF Summary Multiple Industrial products are affected by a vulnerability in the Interniche IP-Stack. The affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Interniche IP-Stack are affected: SIDOOR ATD430W (CVE-2025-40820) SIDOOR ATE530G COATED (6FB1221-5SM10-7BP0) (CVE-2025-40820) SIDOOR ATE530S COATED (CVE-2025-40820) SIMATIC CFU DIQ (6ES7655-5PX31-1XX0) (CVE-2025-40820) SIMATIC CFU PA (6ES7655-5PX11-0XX0) (CVE-2025-40820) SIMATIC CFU PA (6ES7655-5PX11-1XX0) (CVE-2025-40820) SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (CVE-2025-40820) SIMATIC ET 200clean, CM 8x IO-Link (6ES7148-7JH00-0BB0) (CVE-2025-40820) SIMATIC ET 200clean, DI 16x24VDC (6ES7141-7BH00-0BB0) (CVE-2025-40820) SIMATIC ET 200clean, DIQ 16x24VDC/0,5A (6ES7143-7BH00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0) (CVE-2025-40820) SIMATIC ET 200eco PN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0) (CVE-2025-40820) SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (CVE-2025-40820) SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0) (CVE-2025-40820) SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0) (CVE-2025-40820) SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) (CVE-2025-40820) SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0) (CVE-2025-40820) SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0) (CVE-2025-40820) SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0) (CVE-2025-40820) SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0) (CVE-2025-40820) SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0) (CVE-2025-40820) SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0) (CVE-2025-40820) SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (CVE-2025-40820) SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (CVE-2025-40820) SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0) (CVE-2025-40820) SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (CVE-2025-40820) SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (CVE-2025-40820) SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (CVE-2025-40820) SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (CVE-2025-40820) SIMATIC Power Line Booster PLB, Base Module (6ES7972-5AA10-0AB0) (CVE-2025-40820) SIMATIC Power Line Booster PLB, Modem Module ST (6ES7972-5AA51-0AB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1211C DC/DC/Rly (6ES7211-1HE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1212C AC/DC/Rly (6ES7212-1BE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1212C DC/DC/Rly (6ES7212-1HE40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1212FC DC/DC/DC (6ES7212-1AF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1212FC DC/DC/Rly (6ES7212-1HF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1214C AC/DC/Rly (6ES7214-1BG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1214C DC/DC/Rly (6ES7214-1HG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1214FC DC/DC/DC (6ES7214-1AF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1214FC DC/DC/Rly (6ES7214-1HF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1215C AC/DC/Rly (6ES7215-1BG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1215C DC/DC/Rly (6ES7215-1HG40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1215FC DC/DC/DC (6ES7215-1AF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1215FC DC/DC/Rly (6ES7215-1HF40-0XB0) (CVE-2025-40820) SIMATIC S7-1200 CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0) (CVE-2025-40820) SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA1) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA0) (CVE-2025-40820) SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1) (CVE-2025-40820) SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0) (CVE-2025-40820) SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0) (CVE-2025-40820) SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0) (CVE-2025-40820) SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0) (CVE-2025-40820) SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0) (CVE-2025-40820) SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0) (CVE-2025-40820) SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0) (CVE-2025-40820) SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (CVE-2025-40820) SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (CVE-2025-40820) SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (CVE-2025-40820) SIMATIC TDC CP51M1 (CVE-2025-40820) SIMATIC TDC CPU555 (CVE-2025-40820) SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants) (CVE-2025-40820) SIMOCODE pro V PROFINET (CVE-2025-40820) SINUMERIK 840D sl (CVE-2025-40820) SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (CVE-2025-40820) SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (CVE-2025-40820) SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (CVE-2025-40820) SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0) (CVE-2025-40820) SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0) (CVE-2025-40820) SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK00-2AB0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (CVE-2025-40820) SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (CVE-2025-40820) SIPLUS HCS4200 CIM4210 (6BK1942-1AA00-0AA0) (CVE-2025-40820) SIPLUS HCS4200 CIM4210C (6BK1942-1AA00-0AA1) (CVE-2025-40820) SIPLUS HCS4300 CIM4310 (6BK1943-1AA00-0AA0) (CVE-2025-40820) SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212C AC/DC/RLY (6AG1212-1BE40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL (6AG2212-1AE40-1XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C AC/DC/RLY (6AG1214-1BG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C AC/DC/RLY (6AG1214-1BG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL (6AG2214-1AG40-1XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/RLY (6AG1214-1HG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214C DC/DC/RLY (6AG1214-1HG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214FC DC/DC/DC (6AG1214-1AF40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1214FC DC/DC/RLY (6AG1214-1HF40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-4XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215C AC/DC/RLY (6AG1215-1BG40-2XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215C DC/DC/DC (6AG1215-1AG40-5XB0) (CVE-2025-40820) SIPLUS S7-1200 CPU 1215FC DC/DC/DC (6AG1215-1AF40-5XB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0) (CVE-2025-40820) SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0) (CVE-2025-40820) SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0) (CVE-2025-40820) SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0) (CVE-2025-40820) SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0) (CVE-2025-40820) SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0) (CVE-2025-40820) SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0) (CVE-2025-40820) SIPLUS S7-400 CPU 414-3 PN/DP V7 (6AG1414-3EM07-7AB0) (CVE-2025-40820) SIPLUS S7-400 CPU 416-3 PN/DP V7 (6AG1416-3ES07-7AB0) (CVE-2025-40820) SIWAREX WP231 (7MH4960-2AA01) (CVE-2025-40820) SIWAREX WP241 (7MH4960-4AA01) (CVE-2025-40820) SIWAREX WP251 (7MH4960-6AA01) (CVE-2025-40820) SIWAREX WP521 ST (7MH4980-1AA01) (CVE-2025-40820) SIWAREX WP522 ST (7MH4980-2AA01) (CVE-2025-40820) CVSS Vendor Equipment Vulnerabilities v3 7.5 Siemens Siemens Interniche IP-Stack Improper Verification of Source of a Communication Channel Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2025-40820 Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services. View CVE Details Affected Products Siemens Interniche IP-Stack Vendor: Siemens Product Version: SIDOOR ATD430W, SIDOOR ATE530G COATED (6FB1221-5SM10-7BP0), SIDOOR ATE530S COATED, SIMATIC CFU DIQ (6ES7655-5PX31-1XX0), SIMATIC CFU PA (6ES7655-5PX11-0XX0), SIMATIC CFU PA (6ES7655-5PX11-1XX0), SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0), SIMATIC ET 200clean, CM 8x IO-Link (6ES7148-7JH00-0BB0), SIMATIC ET 200clean, DI 16x24VDC (6ES7141-7BH00-0BB0), SIMATIC ET 200clean, DIQ 16x24VDC/0,5A (6ES7143-7BH00-0BB0), SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0), SIMATIC ET 200eco PN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0), SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0), SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0), SIMATIC ET 200eco PN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0), SIMATIC ET 200eco PN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0), SIMATIC ET 200eco PN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0), SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0), SIMATIC ET 200eco PN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0), SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0), SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0), SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0), SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0), SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0), SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0), SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0), SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0), SIMATIC Power Line Booster PLB, Base Module (6ES7972-5AA10-0AB0), SIMATIC Power Line Booster PLB, Modem Module ST (6ES7972-5AA51-0AB0), SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/Rly (6ES7211-1HE40-0XB0), SIMATIC S7-1200 CPU 1212C AC/DC/Rly (6ES7212-1BE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0), SIMATIC S7-1200 CPU 1212C DC/DC/Rly (6ES7212-1HE40-0XB0), SIMATIC S7-1200 CPU 1212FC DC/DC/DC (6ES7212-1AF40-0XB0), SIMATIC S7-1200 CPU 1212FC DC/DC/Rly (6ES7212-1HF40-0XB0), SIMATIC S7-1200 CPU 1214C AC/DC/Rly (6ES7214-1BG40-0XB0), SIMATIC S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0), SIMATIC S7-1200 CPU 1214C DC/DC/Rly (6ES7214-1HG40-0XB0), SIMATIC S7-1200 CPU 1214FC DC/DC/DC (6ES7214-1AF40-0XB0), SIMATIC S7-1200 CPU 1214FC DC/DC/Rly (6ES7214-1HF40-0XB0), SIMATIC S7-1200 CPU 1215C AC/DC/Rly (6ES7215-1BG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0), SIMATIC S7-1200 CPU 1215C DC/DC/Rly (6ES7215-1HG40-0XB0), SIMATIC S7-1200 CPU 1215FC DC/DC/DC (6ES7215-1AF40-0XB0), SIMATIC S7-1200 CPU 1215FC DC/DC/Rly (6ES7215-1HF40-0XB0), SIMATIC S7-1200 CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0), SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0), SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0), SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0), SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0), SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0), SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0), SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0), SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA1), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA0), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA1), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA0), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA1), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA0), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA0), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA1), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA0), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA1), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA0), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA1), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA0), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1), SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0), SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0), SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0), SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0), SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0), SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0), SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0), SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0), SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0), SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0), SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0), SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0), SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants), SIMOCODE pro V PROFINET, SINUMERIK 840D sl, SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0), SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0), SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0), SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK00-2AB0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0), SIPLUS HCS4200 CIM4210 (6BK1942-1AA00-0AA0), SIPLUS HCS4200 CIM4210C (6BK1942-1AA00-0AA1), SIPLUS HCS4300 CIM4310 (6BK1943-1AA00-0AA0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0), SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-4XB0), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-2XB0), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-4XB0), SIPLUS S7-1200 CPU 1212C AC/DC/RLY (6AG1212-1BE40-2XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-2XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-4XB0), SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL (6AG2212-1AE40-1XB0), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-5XB0), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-2XB0), SIPLUS S7-1200 CPU 1214C AC/DC/RLY (6AG1214-1BG40-2XB0), SIPLUS S7-1200 CPU 1214C AC/DC/RLY (6AG1214-1BG40-4XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-2XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-4XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC (6AG1214-1AG40-5XB0), SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL (6AG2214-1AG40-1XB0), SIPLUS S7-1200 CPU 1214C DC/DC/RLY (6AG1214-1HG40-4XB0), SIPLUS S7-1200 CPU 1214C DC/DC/RLY (6AG1214-1HG40-5XB0), SIPLUS S7-1200 CPU 1214FC DC/DC/DC (6AG1214-1AF40-5XB0), SIPLUS S7-1200 CPU 1214FC DC/DC/RLY (6AG1214-1HF40-5XB0), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-4XB0), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-5XB0), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-2XB0), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-4XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-2XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-4XB0), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-5XB0), SIPLUS S7-1200 CPU 1215C AC/DC/RLY (6AG1215-1BG40-2XB0), SIPLUS S7-1200 CPU 1215C DC/DC/DC (6AG1215-1AG40-5XB0), SIPLUS S7-1200 CPU 1215FC DC/DC/DC (6AG1215-1AF40-5XB0), SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0), SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0), SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0), SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0), SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0), SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0), SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0), SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0), SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0), SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0), SIPLUS S7-400 CPU 414-3 PN/DP V7 (6AG1414-3EM07-7AB0), SIPLUS S7-400 CPU 416-3 PN/DP V7 (6AG1416-3ES07-7AB0), SIWAREX WP231 (7MH4960-2AA01), SIWAREX WP241 (7MH4960-4AA01), SIWAREX WP251 (7MH4960-6AA01), SIWAREX WP521 ST (7MH4980-1AA01), SIWAREX WP522 ST (7MH4980-2AA01) Product Status: known_affected Remediations Mitigation As a mitigation, disable the ethernet ports on the CPU and use a communication module (like CP) for communication instead No fix planned Currently no fix is planned None available Currently no fix is available Vendor fix Update to V1.3 or later version Vendor fix Update to V10.2 or later version Vendor fix Update to V2.0.0 or later version Vendor fix Update to V2.0.0 or later version Vendor fix Update to V4.4.0 or later version Vendor fix Update to V6.0.0 or later version Vendor fix Update to V8.3 or later version Workaround Limit TCP accessibility to trusted IP address Relevant CWE: CWE-940 Improper Verification of Source of a Communication Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. Qian Zou, Xuewei Feng, Ke Xu, Qi Li, Xueying Li, and Gang Jin of Zhongguancun Laboratory reported this vulnerability to Siemens Qian Zou, Xuewei Feng, Ke Xu, Qi Li, Xueying Li, and Gang Jin of Tsinghua University reported this vulnerability to Siemens General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-915282 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Schneider Electric is aware of a vulnerability disclosed by Microsoft in the Microsoft Windows Server Update Services (WSUS) used in the EcoStruxure™ Foxboro DCS Advisor services. The EcoStruxure™ Foxboro DCS Advisor, an optional component of the [EcoStruxure™ Foxboro DCS system](https://www.se.com/ww/en/work/products/industrial-automation-control/foxboro-dcs/), facilitates remote connectivity and diagnostics by continuously monitoring key performance indicators (KPI) on the I/A Series or Control Software system's process. Failure to apply the remediations provided below may risk a potential remote code execution event, which could result in system-level privileges acquired by unauthorized parties. The following versions of Schneider Electric EcoStruxure Foxboro DCS Advisor are affected: EcoStruxure™ Foxboro DCS Advisor services () CVSS Vendor Equipment Vulnerabilities v3 9.8 Schneider Electric Schneider Electric EcoStruxure Foxboro DCS Advisor Deserialization of Untrusted Data Background Critical Infrastructure Sectors: Critical Manufacturing, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: France Vulnerabilities Expand All + CVE-2025-59287 A vulnerability disclosed by Microsoft in the Microsoft Windows Server Update Services (WSUS) application impacts servers running Schneider Electric EcoStruxure™ Foxboro DCS Advisor. CVE ID: CVE-2025-59287. Additional information about CVE-2025-59287can be found here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 View CVE Details Affected Products Schneider Electric EcoStruxure Foxboro DCS Advisor Vendor: Schneider Electric Product Version: Product Status: fixed, known_affected Remediations Vendor fix Patch KB5070882 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed. Vendor fix Patch KB5070884 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Acknowledgments Schneider Electric CPCERT reported this vulnerability to CISA. General Security Recommendations We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the “Program” mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document. For More Information This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp LEGAL DISCLAIMER THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION About Schneider Electric Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2025-343-02 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1.0.0 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to be granted direct SYSTEM-level code execution on the host operating system running the Ignition Gateway service on Windows systems. The following versions of Inductive Automation Ignition are affected: Ignition (CVE-2025-13911) CVSS Vendor Equipment Vulnerabilities v3 6.4 Inductive Automation Inductive Automation Ignition Execution with Unnecessary Privileges Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-13911 The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence of proper security controls that restrict which Python libraries can be imported and executed within the scripting environment. The core issue lies in the Ignition service account having system permissions beyond what an Ignition privileged user requires. When an authenticated administrator uploads a malicious project file containing Python scripts with bind shell capabilities, the application executes these scripts with the same privileges as the Ignition Gateway process, which typically runs with SYSTEM-level permissions on Windows. Alternative code execution patterns could lead to similar results. View CVE Details Affected Products Inductive Automation Ignition Vendor: Inductive Automation Product Version: Inductive Automation Ignition: 8.1.x|8.3.x Product Status: known_affected Remediations Mitigation Inductive Automation encourages users to do the following in order to reduce the risk of this vulnerability: Mitigation For more information and updates, users should refer to Inductive Automation's Trust Portal. Relevant CWE: CWE-250 Execution with Unnecessary Privileges Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.4 MEDIUM CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Acknowledgments Momen Eldawakhly of Samurai Digital Security Ltd reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could allow an authenticated attacker to read or modify a remote database. The following versions of Advantech WebAccess/SCADA are affected: WebAccess/SCADA (CVE-2025-14850, CVE-2025-14849, CVE-2025-14848, CVE-2025-46268, CVE-2025-67653) CVSS Vendor Equipment Vulnerabilities v3 8.8 Advantech Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Absolute Path Traversal, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Taiwan, Province of China Vulnerabilities Expand All + CVE-2025-14850 The affected product is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2025-14849 The affected product is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-14848 The affected product is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-36 Absolute Path Traversal Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2025-46268 The affected product is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2025-67653 The affected product is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Acknowledgments Alex Wiliams of Pellera Technologies reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. The following versions of National Instruments LabView are affected: LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) CVSS Vendor Equipment Vulnerabilities v3 7.8 National Instruments National Instruments LabView Out-of-bounds Write, Out-of-bounds Read, Use After Free, Stack-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Defense Industrial Base, Information Technology, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-64461 LabVIEW is vulnerable to an out-of-bounds write vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-787 Out-of-bounds Write Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64462 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::RGetMemFileHandle() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64463 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResource::DetachResource() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64464 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!VisaWriteFromFile() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64465 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!DataSizeTDR() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64466 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!ExecPostedProcRecPost() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64467 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::FindRsrcListEntry() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64468 LabVIEW is vulnerable to a use-after-free vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-416 Use After Free Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64469 LabVIEW is vulnerable to a stack-based buffer overflow vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-121 Stack-based Buffer Overflow Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Acknowledgments Michael Heinzl reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

CISA released nine Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-352-01 Inductive Automation Ignition ICSA-25-352-02 Schneider Electric EcoStruxure Foxboro DCS Advisor ICSA-25-352-03 National Instruments LabView ICSA-25-352-04 Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products ICSA-25-352-05 Siemens Interniche IP-Stack ICSA-25-352-06 Advantech WebAccess/SCADA ICSA-25-352-07 Rockwell Automation Micro820, Micro850, Micro 870 ICSA-25-352-08 Axis Communications Camera Station Pro, Camera Station, and Device Manager ICSA-24-291-03 Mitsubishi Electric CNC Series (Update C) CISA encourages users and administrators to review newly released ICS Advisories for technical details and mitigations.

View CSAF Summary Successful exploitation of these vulnerabilities could result in an attacker executing arbitrary code, executing a man-in-middle style attack, or bypass authentication. The following versions of Axis Communications Camera Station Pro, Camera Station, and Device Manager are affected: AXIS Camera Station Pro (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Camera Station (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Device Manager (CVE-2025-30023, CVE-2025-30024, CVE-2025-30025) CVSS Vendor Equipment Vulnerabilities v3 9 Axis Communications Axis Communications Camera Station Pro, Camera Station, and Device Manager Deserialization of Untrusted Data, Improper Certificate Validation, Authentication Bypass Using an Alternate Path or Channel Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2025-30023 The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2025-30024 The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-295 Improper Certificate Validation Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2025-30025 The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.2 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVE-2025-30026 The AXIS Camera Station Server had a flaw that allowed users to bypass authentication that is normally required. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.1 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L Acknowledgments Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could result in denial-of-service (DoS), information tampering, and information disclosure. The following versions of Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products are affected: GENESIS64 (CVE-2025-11774) ICONICS Suite (CVE-2025-11774) MobileHMI (CVE-2025-11774) MC Works64 (CVE-2025-11774) CVSS Vendor Equipment Vulnerabilities v3 8.2 Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan, United States Vulnerabilities Expand All + CVE-2025-11774 Malicious code execution vulnerability exists in the software keyboard function (hereinafter referred to as "keypad function") of ICONICS Suite, GENESIS64, MobileHMI, and MC Works64, which could lead to denial-of-service (DoS), information tampering, and information disclosure. An attacker may be able to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the keypad function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected produc is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE. View CVE Details Affected Products Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Product Version: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric GENESIS64: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric ICONICS Suite: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MobileHMI: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MC Works64: vers:all/* Product Status: known_affected Remediations Vendor fix Mitsubishi Electric Iconics Digital Solutions recommends users of GENESIS64, IONICS Suite, or MobileHMI upgrade to the GENESIS64 v10.97.3 or higher, or upgrade to the latest product, GENESIS V11, which all contain the fix for this vulnerability. Mitigation Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3." Vendor fix The latest patch version for GENESIS64 Version 10.97.3 can be downloaded from the link below: Mitigation https://iconicsinc.my.site.com/community/s/software-update/a35QQ000000y2oXYAQ/10973-critical-fixes-rollup-2 Vendor fix There are no plans to release a fixed version of MC Works64. Mitsubishi Electric recommends users of MC Works64 upgrade to the GENESIS64 v10.97.3 or higher. Mitigation Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommends users take the following mitigations to minimize the risk of exploiting this vulnerability: Mitigation Use the PCs with the affected product installed in the LAN and block remote login from untrusted networks, hosts and users. Mitigation Block unauthorized access by using a firewall or virtual private network (VPN), etc., and allow remote login only to trusted users when connecting the PCs with the affected product installed to the Internet. Mitigation Restrict physical access to the PC with the affected product installed and the network to which the PC is connected to prevent unauthorized physical access. Mitigation Do not click web links in emails from untrusted sources. Also, do not open attachments in untrusted emails. Mitigation Install an antivirus software in the PC with the affected product installed. Mitigation Refer to the Mitsubishi Electric Iconics Digital Solutions Whitepaper on Security Vulnerabilities, the most recent version of which can be found at: https://iconics.com/About/Security/CERT Mitigation Refer to the Mitsubishi Electric security advisory at: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf for information on the availability of the security updates. Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Acknowledgments Mitsubishi Electric Iconics Digital Solutions reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could result in a denial-of-service condition. The following versions of Rockwell Automation Micro820, Micro850, Micro870 are affected: Micro820 (CVE-2025-13823, CVE-2025-13824) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation Micro820, Micro850, Micro870 Dependency on Vulnerable Third-Party Component, Release of Invalid Pointer or Reference Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-13823 A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers. This issue occurs when the controllers received multiple malformed packets during fuzzing, causing a recoverable fault. View CVE Details Affected Products Rockwell Automation Micro820, Micro850, Micro870 Vendor: Rockwell Automation Product Version: Rockwell Automation Micro820: <=V14.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users of Micro820 V14.011 and prior update to newer Micro820 controllers (L20E V23.011 or later). Mitigation Rockwell Automation recommends users of Micro850/870 update to V12.013 or later. The update can be downloaded from the Rockwell Automation website. Mitigation For CVE-2025-13823, Rockwell Automation advises users to disable IPv6 functionalities if they do not require the feature. Mitigation Rockwell Automation users using the affected software, who are not able to upgrade to one of the corrected versions, should follow Rockwell Automation's security best practices. Mitigation For more information, please review Rockwell Automation's advisory. Relevant CWE: CWE-1395 Dependency on Vulnerable Third-Party Component Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-13824 A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with a solid red Fault LED and becomes unresponsive. Upon power cycling, the controller will enter a recoverable fault. View CVE Details Affected Products Rockwell Automation Micro820, Micro850, Micro870 Vendor: Rockwell Automation Product Version: Rockwell Automation Micro820: <=V14.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users of Micro820 V14.011 and prior update to newer Micro820 controllers (L20E V23.011 or later). Mitigation Rockwell Automation recommends users of Micro850/870 update to V12.013 or later. The update can be downloaded from the Rockwell Automation website. Mitigation Rockwell Automation users using the affected software, who are not able to upgrade to one of the corrected versions, should follow Rockwell Automation's security best practices. Mitigation For more information, please review Rockwell Automation's advisory. Relevant CWE: CWE-763 Release of Invalid Pointer or Reference Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Acknowledgments Rockwell Automation reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-20393 Cisco Multiple Products Improper Input Validation Vulnerability CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of Güralp Systems Fortimus Series, Minimus Series, and Certimus Series are affected: Fortimus Series (CVE-2025-14466) Minimus Series (CVE-2025-14466) Certimus Series (CVE-2025-14466) CVSS Vendor Equipment Vulnerabilities v3 5.3 Güralp Systems Güralp Systems Fortimus Series, Minimus Series, and Certimus Series Allocation of Resources Without Limits or Throttling Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United Kingdom Vulnerabilities Expand All + CVE-2025-14466 A vulnerability in the web interface of the Güralp Fortimus Series, Minimus Series and Certimus Series allows an unauthenticated attacker with network access to send specially-crafted HTTP requests that can cause the web service process to deliberately restart. Although this mechanism limits the impact of the attack, it results in a brief denial-of-service condition during the restart. View CVE Details Affected Products Güralp Systems Fortimus Series, Minimus Series, and Certimus Series Vendor: Güralp Systems Product Version: Güralp Systems Fortimus Series: vers:all/*, Güralp Systems Minimus Series: vers:all/*, Güralp Systems Certimus Series: vers:all/* Product Status: known_affected Remediations Mitigation Güralp Systems recommends that users operate their systems behind a NAT or VPN firewall. For more information, please contact Güralp Systems. Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Acknowledgments Souvik Kandar reported this vulnerability to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use

CISA released six Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-350-01 Güralp Systems FMUS (Fortimus) Series and MIN (Minimus) Series ICSA-25-350-02 Johnson Controls PowerG, IQPanel and IQHub ICSA-25-350-03 Hitachi Energy AFS, AFR and AFF Series ICSA-25-350-04 Mitsubishi Electric GT Designer3 ICSA-25-224-02 Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 (Update A) ICSA-25-308-01 Fuji Electric Monitouch V-SFT-6 (Update A) CISA encourages users and administrators to review newly released ICS Advisories for technical details and mitigations.

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker obtain plaintext credentials from the project file for GT Designer3, which could result in illegally operating GOT2000 and GOT1000 series devices. The following versions of Mitsubishi Electric GT Designer3 are affected: GT Designer3 Version1 (GOT2000) (CVE-2025-11009) GT Designer3 Version1 (GOT1000) (CVE-2025-11009) CVSS Vendor Equipment Vulnerabilities v3 5.1 Mitsubishi Electric Mitsubishi Electric GT Designer3 Cleartext Storage of Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan Vulnerabilities Expand All + CVE-2025-11009 Information Disclosure vulnerability due to Cleartext Storage of Sensitive Information(CWE-312) exists in GT Designer3. GT Designer3 stores credentials and verifies them in plain text, therefore an attacker may be able to obtain plaintext credentials from the project file for GT Designer3. As a result, the attacker may be able to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials. View CVE Details Affected Products Mitsubishi Electric GT Designer3 Vendor: Mitsubishi Electric Product Version: Mitsubishi Electric GT Designer3 Version1 (GOT2000): vers:all/*, Mitsubishi Electric GT Designer3 Version1 (GOT1000): vers:all/* Product Status: known_affected Remediations Mitigation Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting this vulnerability: Mitigation Use a personal computer with the affected product within the LAN and block remote login from untrusted networks, hosts, and users. Mitigation When connecting a personal computer with the affected product to the Internet, use a firewall, virtual private network (VPN), etc., to prevent unauthorized access and allow only trusted users to remote login. Mitigation Install an antivirus software on the computer using the affected product. Mitigation Don't open untrusted files or click untrusted links. Mitigation For more information, see Mitsubishi Electric's security advisory. Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.1 MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Acknowledgments Hea-Eun Moon and Junbeom Gwak of Red Alert Lab at NSHC reported this vulnerability to Mitsubishi Electric Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could compromise the integrity of the product data and disrupt its availability. The following versions of Hitachi Energy AFS, AFR and AFF Series are affected: AFS 660-B/C/S (CVE-2024-3596) AFS 665-B/S (CVE-2024-3596) AFS 670 v2.0 (CVE-2024-3596) AFS 650 (CVE-2024-3596) AFS 655 (CVE-2024-3596) AFS 670 (CVE-2024-3596) AFS 675 (CVE-2024-3596) AFS 677 (CVE-2024-3596) AFR 677 (CVE-2024-3596) AFF 660 (CVE-2024-3596) AFF 665 (CVE-2024-3596) CVSS Vendor Equipment Vulnerabilities v3 9 Hitachi Energy Hitachi Energy AFS, AFR and AFF Series Improper Enforcement of Message Integrity During Transmission in a Communication Channel Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2024-3596 The RADIUS protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid response (access-accept, access-reject, or access-challenge) to any other response using a chosen-prefix collision attack against the MD5 response authenticator signature. View CVE Details Affected Products Hitachi Energy AFS, AFR and AFF Series Vendor: Hitachi Energy Product Version: Hitachi Energy AFS 660-B/C/S: vers:all/*, Hitachi Energy AFS 665-B/S: vers:all/*, Hitachi Energy AFS 670 v2.0: vers:all/*, Hitachi Energy AFS 650: vers:all/*, Hitachi Energy AFS 655: vers:all/*, Hitachi Energy AFS 670: vers:all/*, Hitachi Energy AFS 675: vers:all/*, Hitachi Energy AFS 677: vers:all/*, Hitachi Energy AFR 677: vers:all/*, Hitachi Energy AFF 660: vers:all/*, Hitachi Energy AFF 665: vers:all/* Product Status: known_affected Remediations Mitigation Hitachi Energy has identified the following recommended immediate actions: Mitigation All affected products: Set the RADIUS configuration to default which enables the RADIUS server message authenticator option. Vendor fix AFR 677, AFS 650, AFS 655, AFS 670, AFS 675, AFS 677: Command to enable Message Authenticator option: For AFS65x, AFS67x, AFR67x CLI: radius server msgauth MIB: hmAgentRadiusServerMsgAuth Vendor fix AFF 660, AFF 665, AFS 660-B/C/S, AFS 665-B/S, AFS 670: Command to enable Message Authenticator option: For AFS66x, AFS670 v2.0, AFF66x CLI: radius server auth modify msgauth MIB: hm2AgentRadiusServerMsgAuth Mitigation For more information, see the associated Hitachi Energy PSIRT security advisory 8DBD000230 RADIUS vulnerability in Hitachi Energy AFS, AFR and AFF series products. Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Acknowledgments Hitachi Energy reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write encrypted traffic or perform a replay attack. The following versions of Johnson Controls PowerG, IQPanel and IQHub are affected: PowerG (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQHub (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2+ (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 4 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) CVSS Vendor Equipment Vulnerabilities v3 7.6 Johnson Controls Inc. Johnson Controls PowerG, IQPanel and IQHub Cleartext Transmission of Sensitive Information, Reusing a Nonce, Key Pair in Encryption, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Origin Validation Error Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2025-61738 The affected product is vulnerable due to cleartext transmission of sensitive information. This may allow an attacker to capture the network key and read or write encrypted packets on the PowerG network. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2025-61739 The affected product is vulnerable due to nonce reuse, which may allow an attacker to perform a replay attack or decrypt captured packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-26379 The affected product is vulnerable due to a weak pseudo-random number generator. This may allow an attacker to read or inject encrypted PowerG packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-61740 The affected product is vulnerable to an authentication issue that does not verify the source of a packet. This could allow an attacker to create a denial-of-service condition or modify the configuration of the device. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-346 Origin Validation Error Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Acknowledgments James Chambers and Sultan Qasim Khan of NCC Group reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities have been reported to CISA at this time. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use