CISA Advisories

View CSAF Summary Schneider Electric is aware of a vulnerability disclosed by Microsoft in the Microsoft Windows Server Update Services (WSUS) used in the EcoStruxure™ Foxboro DCS Advisor services. The EcoStruxure™ Foxboro DCS Advisor, an optional component of the [EcoStruxure™ Foxboro DCS system](https://www.se.com/ww/en/work/products/industrial-automation-control/foxboro-dcs/), facilitates remote connectivity and diagnostics by continuously monitoring key performance indicators (KPI) on the I/A Series or Control Software system's process. Failure to apply the remediations provided below may risk a potential remote code execution event, which could result in system-level privileges acquired by unauthorized parties. The following versions of Schneider Electric EcoStruxure Foxboro DCS Advisor are affected: EcoStruxure™ Foxboro DCS Advisor services () CVSS Vendor Equipment Vulnerabilities v3 9.8 Schneider Electric Schneider Electric EcoStruxure Foxboro DCS Advisor Deserialization of Untrusted Data Background Critical Infrastructure Sectors: Critical Manufacturing, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: France Vulnerabilities Expand All + CVE-2025-59287 A vulnerability disclosed by Microsoft in the Microsoft Windows Server Update Services (WSUS) application impacts servers running Schneider Electric EcoStruxure™ Foxboro DCS Advisor. CVE ID: CVE-2025-59287. Additional information about CVE-2025-59287can be found here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 View CVE Details Affected Products Schneider Electric EcoStruxure Foxboro DCS Advisor Vendor: Schneider Electric Product Version: Product Status: fixed, known_affected Remediations Vendor fix Patch KB5070882 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed. Vendor fix Patch KB5070884 from Microsoft includes a fix for this vulnerability and is available for download directly from WSUS. Reboot may be required to complete patch update. Customers should contact and work with [Global Customer Support](https://pasupport.se.com/home) to verify update has been completed. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Acknowledgments Schneider Electric CPCERT reported this vulnerability to CISA. General Security Recommendations We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the “Program” mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document. For More Information This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp LEGAL DISCLAIMER THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION About Schneider Electric Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2025-343-02 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1.0.0 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could result in denial-of-service (DoS), information tampering, and information disclosure. The following versions of Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products are affected: GENESIS64 (CVE-2025-11774) ICONICS Suite (CVE-2025-11774) MobileHMI (CVE-2025-11774) MC Works64 (CVE-2025-11774) CVSS Vendor Equipment Vulnerabilities v3 8.2 Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan, United States Vulnerabilities Expand All + CVE-2025-11774 Malicious code execution vulnerability exists in the software keyboard function (hereinafter referred to as "keypad function") of ICONICS Suite, GENESIS64, MobileHMI, and MC Works64, which could lead to denial-of-service (DoS), information tampering, and information disclosure. An attacker may be able to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the keypad function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected produc is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE. View CVE Details Affected Products Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Product Version: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric GENESIS64: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric ICONICS Suite: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MobileHMI: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MC Works64: vers:all/* Product Status: known_affected Remediations Vendor fix Mitsubishi Electric Iconics Digital Solutions recommends users of GENESIS64, IONICS Suite, or MobileHMI upgrade to the GENESIS64 v10.97.3 or higher, or upgrade to the latest product, GENESIS V11, which all contain the fix for this vulnerability. Mitigation Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3." Vendor fix The latest patch version for GENESIS64 Version 10.97.3 can be downloaded from the link below: Mitigation https://iconicsinc.my.site.com/community/s/software-update/a35QQ000000y2oXYAQ/10973-critical-fixes-rollup-2 Vendor fix There are no plans to release a fixed version of MC Works64. Mitsubishi Electric recommends users of MC Works64 upgrade to the GENESIS64 v10.97.3 or higher. Mitigation Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommends users take the following mitigations to minimize the risk of exploiting this vulnerability: Mitigation Use the PCs with the affected product installed in the LAN and block remote login from untrusted networks, hosts and users. Mitigation Block unauthorized access by using a firewall or virtual private network (VPN), etc., and allow remote login only to trusted users when connecting the PCs with the affected product installed to the Internet. Mitigation Restrict physical access to the PC with the affected product installed and the network to which the PC is connected to prevent unauthorized physical access. Mitigation Do not click web links in emails from untrusted sources. Also, do not open attachments in untrusted emails. Mitigation Install an antivirus software in the PC with the affected product installed. Mitigation Refer to the Mitsubishi Electric Iconics Digital Solutions Whitepaper on Security Vulnerabilities, the most recent version of which can be found at: https://iconics.com/About/Security/CERT Mitigation Refer to the Mitsubishi Electric security advisory at: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf for information on the availability of the security updates. Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Acknowledgments Mitsubishi Electric Iconics Digital Solutions reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to be granted direct SYSTEM-level code execution on the host operating system running the Ignition Gateway service on Windows systems. The following versions of Inductive Automation Ignition are affected: Ignition (CVE-2025-13911) CVSS Vendor Equipment Vulnerabilities v3 6.4 Inductive Automation Inductive Automation Ignition Execution with Unnecessary Privileges Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-13911 The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence of proper security controls that restrict which Python libraries can be imported and executed within the scripting environment. The core issue lies in the Ignition service account having system permissions beyond what an Ignition privileged user requires. When an authenticated administrator uploads a malicious project file containing Python scripts with bind shell capabilities, the application executes these scripts with the same privileges as the Ignition Gateway process, which typically runs with SYSTEM-level permissions on Windows. Alternative code execution patterns could lead to similar results. View CVE Details Affected Products Inductive Automation Ignition Vendor: Inductive Automation Product Version: Inductive Automation Ignition: 8.1.x|8.3.x Product Status: known_affected Remediations Mitigation Inductive Automation encourages users to do the following in order to reduce the risk of this vulnerability: Mitigation For more information and updates, users should refer to Inductive Automation's Trust Portal. Relevant CWE: CWE-250 Execution with Unnecessary Privileges Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.4 MEDIUM CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Acknowledgments Momen Eldawakhly of Samurai Digital Security Ltd reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could result in an attacker executing arbitrary code, executing a man-in-middle style attack, or bypass authentication. The following versions of Axis Communications Camera Station Pro, Camera Station, and Device Manager are affected: AXIS Camera Station Pro (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Camera Station (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Device Manager (CVE-2025-30023, CVE-2025-30024, CVE-2025-30025) CVSS Vendor Equipment Vulnerabilities v3 9 Axis Communications Axis Communications Camera Station Pro, Camera Station, and Device Manager Deserialization of Untrusted Data, Improper Certificate Validation, Authentication Bypass Using an Alternate Path or Channel Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2025-30023 The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2025-30024 The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-295 Improper Certificate Validation Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2025-30025 The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.2 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVE-2025-30026 The AXIS Camera Station Server had a flaw that allowed users to bypass authentication that is normally required. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.1 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L Acknowledgments Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could allow an authenticated attacker to read or modify a remote database. The following versions of Advantech WebAccess/SCADA are affected: WebAccess/SCADA (CVE-2025-14850, CVE-2025-14849, CVE-2025-14848, CVE-2025-46268, CVE-2025-67653) CVSS Vendor Equipment Vulnerabilities v3 8.8 Advantech Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Absolute Path Traversal, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Taiwan, Province of China Vulnerabilities Expand All + CVE-2025-14850 The affected product is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2025-14849 The affected product is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-14848 The affected product is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-36 Absolute Path Traversal Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2025-46268 The affected product is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2025-67653 The affected product is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. View CVE Details Affected Products Advantech WebAccess/SCADA Vendor: Advantech Product Version: Advantech WebAccess/SCADA: 9.2.1 Product Status: known_affected Remediations Vendor fix Advantech recommends users apply the following mitigations update to WebAccess/SCADA: Version 9.2.2. Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Acknowledgments Alex Wiliams of Pellera Technologies reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. The following versions of National Instruments LabView are affected: LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) CVSS Vendor Equipment Vulnerabilities v3 7.8 National Instruments National Instruments LabView Out-of-bounds Write, Out-of-bounds Read, Use After Free, Stack-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Defense Industrial Base, Information Technology, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-64461 LabVIEW is vulnerable to an out-of-bounds write vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-787 Out-of-bounds Write Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64462 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::RGetMemFileHandle() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64463 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResource::DetachResource() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64464 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!VisaWriteFromFile() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64465 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!DataSizeTDR() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64466 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!ExecPostedProcRecPost() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64467 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::FindRsrcListEntry() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64468 LabVIEW is vulnerable to a use-after-free vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-416 Use After Free Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64469 LabVIEW is vulnerable to a stack-based buffer overflow vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-121 Stack-based Buffer Overflow Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Acknowledgments Michael Heinzl reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-20393 Cisco Multiple Products Improper Input Validation Vulnerability CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write encrypted traffic or perform a replay attack. The following versions of Johnson Controls PowerG, IQPanel and IQHub are affected: PowerG (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQHub (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2+ (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 4 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) CVSS Vendor Equipment Vulnerabilities v3 7.6 Johnson Controls Inc. Johnson Controls PowerG, IQPanel and IQHub Cleartext Transmission of Sensitive Information, Reusing a Nonce, Key Pair in Encryption, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Origin Validation Error Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2025-61738 The affected product is vulnerable due to cleartext transmission of sensitive information. This may allow an attacker to capture the network key and read or write encrypted packets on the PowerG network. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2025-61739 The affected product is vulnerable due to nonce reuse, which may allow an attacker to perform a replay attack or decrypt captured packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-26379 The affected product is vulnerable due to a weak pseudo-random number generator. This may allow an attacker to read or inject encrypted PowerG packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-61740 The affected product is vulnerable to an authentication issue that does not verify the source of a packet. This could allow an attacker to create a denial-of-service condition or modify the configuration of the device. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-346 Origin Validation Error Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Acknowledgments James Chambers and Sultan Qasim Khan of NCC Group reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities have been reported to CISA at this time. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

View CSAF Summary Successful exploitation of this vulnerability could compromise the integrity of the product data and disrupt its availability. The following versions of Hitachi Energy AFS, AFR and AFF Series are affected: AFS 660-B/C/S (CVE-2024-3596) AFS 665-B/S (CVE-2024-3596) AFS 670 v2.0 (CVE-2024-3596) AFS 650 (CVE-2024-3596) AFS 655 (CVE-2024-3596) AFS 670 (CVE-2024-3596) AFS 675 (CVE-2024-3596) AFS 677 (CVE-2024-3596) AFR 677 (CVE-2024-3596) AFF 660 (CVE-2024-3596) AFF 665 (CVE-2024-3596) CVSS Vendor Equipment Vulnerabilities v3 9 Hitachi Energy Hitachi Energy AFS, AFR and AFF Series Improper Enforcement of Message Integrity During Transmission in a Communication Channel Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2024-3596 The RADIUS protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid response (access-accept, access-reject, or access-challenge) to any other response using a chosen-prefix collision attack against the MD5 response authenticator signature. View CVE Details Affected Products Hitachi Energy AFS, AFR and AFF Series Vendor: Hitachi Energy Product Version: Hitachi Energy AFS 660-B/C/S: vers:all/*, Hitachi Energy AFS 665-B/S: vers:all/*, Hitachi Energy AFS 670 v2.0: vers:all/*, Hitachi Energy AFS 650: vers:all/*, Hitachi Energy AFS 655: vers:all/*, Hitachi Energy AFS 670: vers:all/*, Hitachi Energy AFS 675: vers:all/*, Hitachi Energy AFS 677: vers:all/*, Hitachi Energy AFR 677: vers:all/*, Hitachi Energy AFF 660: vers:all/*, Hitachi Energy AFF 665: vers:all/* Product Status: known_affected Remediations Mitigation Hitachi Energy has identified the following recommended immediate actions: Mitigation All affected products: Set the RADIUS configuration to default which enables the RADIUS server message authenticator option. Vendor fix AFR 677, AFS 650, AFS 655, AFS 670, AFS 675, AFS 677: Command to enable Message Authenticator option: For AFS65x, AFS67x, AFR67x CLI: radius server msgauth MIB: hmAgentRadiusServerMsgAuth Vendor fix AFF 660, AFF 665, AFS 660-B/C/S, AFS 665-B/S, AFS 670: Command to enable Message Authenticator option: For AFS66x, AFS670 v2.0, AFF66x CLI: radius server auth modify msgauth MIB: hm2AgentRadiusServerMsgAuth Mitigation For more information, see the associated Hitachi Energy PSIRT security advisory 8DBD000230 RADIUS vulnerability in Hitachi Energy AFS, AFR and AFF series products. Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Acknowledgments Hitachi Energy reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use