Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause a denial-of-service, or configuration information may be altered without authentication.
\nThe following versions of Silex Technology SD-330AC and AMC Manager are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nSilex Technology | \nSilex Technology SD-330AC and AMC Manager | \nStack-based Buffer Overflow, Heap-based Buffer Overflow, Missing Authentication for Critical Function, Use of Hard-coded Cryptographic Key, Dependency on Vulnerable Third-Party Component, Use of a Broken or Risky Cryptographic Algorithm, Sensitive Information in Resource Not Removed Before Reuse, Incorrect Privilege Assignment, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of CRLF Sequences ('CRLF Injection'), Initialization of a Resource with an Insecure Default | \n
A Stack-based Buffer Overflow vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to execute arbitrary code on the device.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32955, CVE-2026-32956, CVE-2026-32957, and CVE-2026-32963: Disable HTTP/HTTPS service.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
A Heap-based Buffer Overflow vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to execute arbitrary code on the device.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32955, CVE-2026-32956, CVE-2026-32957, and CVE-2026-32963: Disable HTTP/HTTPS service.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-122 Heap-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
A Missing Authentication for Critical Function vulnerability in Silex Technology SD-330AC and AMC Manager could allow uploads of arbitrary files to the device without authentication.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32955, CVE-2026-32956, CVE-2026-32957, and CVE-2026-32963: Disable HTTP/HTTPS service.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | \n
A Use of Hard-coded Cryptographic Key vulnerability in Silex Technology SD-330AC and AMC Manager could cause an administrative user to be directed to apply a fake firmware update.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32958 and CVE-2026-32965: Set a password for the settings web interface.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | \n
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash).
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2015-5621: Disable SNMP service.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-1395 Dependency on Vulnerable Third-Party Component
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to retrieve information via a man-in-the-middle attack.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.9 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
A Sensitive Information in Resource Not Removed Before Reuse vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to send specially crafted packets that may allow the attacker to login to the device.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-226 Sensitive Information in Resource Not Removed Before Reuse
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | \n
A Heap-based Buffer Overflow vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to send specially crafted packets that may cause a temporary denial-of-service (DoS) condition.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-122 Heap-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | \n
A Missing Authentication for Critical Function vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to alter the device configuration without authentication.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | \n
An issue discovered in Silex Technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBOOT SYSTEM command.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-266 Incorrect Privilege Assignment
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H | \n
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to trick a user into accessing a special web page and execute arbitrary script on the user's browser.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32955, CVE-2026-32956, CVE-2026-32957, and CVE-2026-32963: Disable HTTP/HTTPS service.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | \n
An Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker to inject arbitrary entries into the system configuration.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | \n
An Initialization of a Resource with an Insecure Default vulnerability in Silex Technology SD-330AC and AMC Manager could allow an attacker using the factory default configuration to configure the device using the null string password.
\n\nVendor fix
The developer has released the following versions to address this vulnerability: SD-330AC firmware Ver 1.50 or later
Vendor fix
AMC Manager Ver.5.1.0 or later
Mitigation
CVE-2026-32958 and CVE-2026-32965: Set a password for the settings web interface.
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/en/2026-001
Mitigation
For more information, see Silex Technology's security advisory in English (https://www.silex.jp/support/security-advisories/en/2026-001) or in Japanese (https://www.silex.jp/support/security-advisories/2026-001).
https://www.silex.jp/support/security-advisories/2026-001
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/en/vu/JVNVU94271449/
Mitigation
For more information, see JPCERT/CC vulnerability notes in English (https://jvn.jp/en/vu/JVNVU94271449/) or in Japanese (https://jvn.jp/vu/JVNVU94271449/).
https://jvn.jp/vu/JVNVU94271449/
Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-21 | \n1 | \nInitial Publication | \n
RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) contains a vulnerability that could allow an attacker to escalate their own privileges. Siemens has released a new version for RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) and recommends to update to the latest version.
\nThe following versions of Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nSiemens | \nSiemens RUGGEDCOM CROSSBOW Secure Access Manager Primary | \nIncorrect Privilege Assignment | \n
User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.
\n\nVendor fix
Update to V5.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000841/
Relevant CWE: CWE-266 Incorrect Privilege Assignment
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-741509 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-741509 advisory | \n
The products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
\nThe following versions of Siemens TPM 2.0 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.6 | \nSiemens | \nSiemens TPM 2.0 | \nOut-of-bounds Read | \n
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
\n\nNo fix planned
Currently no fix is planned
None available
Currently no fix is available
Vendor fix
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Vendor fix
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Vendor fix
Update to V30.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Vendor fix
Update to V32.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Vendor fix
Update to V34.01.02 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.6 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-628843 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-628843 advisory | \n
Successful exploitation of these vulnerabilities could allow an attacker to take complete control of the device.
\nThe following versions of SenseLive X3050 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nSenseLive | \nSenseLive X3050 | \nAuthentication Bypass Using an Alternate Path or Channel, Insufficient Session Expiration, Use of Hard-coded Credentials, Insufficiently Protected Credentials, Missing Authentication for Critical Function, Cleartext Transmission of Sensitive Information, Missing Authorization, Cross-Site Request Forgery (CSRF) | \n
A vulnerability in the X3050's web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive configuration functions.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
A vulnerability exists in the X3050's web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continue interacting with administrative functions long after legitimate user activity has ceased.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-613 Insufficient Session Expiration
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | \n
A vulnerability in the X3050's web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these exposed parameters and gain unauthorized access to administrative functionality.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
A vulnerability exists in the X3050's web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-522 Insufficiently Protected Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
A vulnerability exists in the X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can induce a persistent lockout state. Because the device lacks a physical reset button, recovery requires specialized technical access via the console to perform a factory reset, resulting in a total denial-of-service for the gateway and its connected RS-485 downstream systems.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | \n
A vulnerability exists in the X3050's web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication attempts and configuration data, is transmitted in cleartext, an attacker with access to the same network segment could intercept or observe sensitive operational information.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
A vulnerability in the X3050's web management interface allows critical system and network configuration parameters to be modified without sufficient validation and safety controls. Due to inadequate enforcement of constraints on sensitive functions, parameters such as IP addressing, watchdog timers, reconnect intervals, and service ports can be set to unsupported or unsafe values. These configuration changes directly affect core device behaviour and recovery mechanisms. The lack of proper validation and safeguards allows critical system functions to be altered in a manner that can destabilize device operation or render the device persistently unavailable.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | \n
A vulnerability in the X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF) protections. Because the application does not enforce server-side validation of request origin or implement CSRF tokens, a malicious external webpage could cause a user's browser to submit unauthorized configuration requests to the device.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | \n
A vulnerability in the X3050's embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
A vulnerability in the X3050's management ecosystem allows unauthenticated discovery of deployed units through the vendor's management protocol, enabling identification of device presence, identifiers, and management interfaces without requiring credentials. Because discovery functions are exposed by the underlying service rather than gated by authentication, an attacker on the same network segment can rapidly enumerate targeted devices.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
A vulnerability in X3050's remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges, integrity of uploaded images, or the authenticity of provided firmware.
\n\nMitigation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact
https://senselive.io/contact
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-21 | \n1 | \nInitial Publication | \n
Multiple Siemens applications are affected by improper certificate validation in Siemens Analytics Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens Analytics Toolkit are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 3.7 | \nSiemens | \nSiemens Analytics Toolkit | \nImproper Certificate Validation | \n
Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
\n\nVendor fix
Update to V225.0 Update 13 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 04 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V2504.0008 or later version
https://support.sw.siemens.com/product/297028302/
Vendor fix
Update to V2506.0002 or later version
https://support.sw.siemens.com/product/275652363/
Vendor fix
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/289054037/
Vendor fix
Update to V2602 or later version
https://support.sw.siemens.com/product/226870983/
Vendor fix
Update to V3.5.8.2 or later version
https://www.sw.siemens.com/en-US/siemens-software-center/
Relevant CWE: CWE-295 Improper Certificate Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n3.7 | \nLOW | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-981622 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-981622 advisory | \n
SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.
\nThe following versions of Siemens SCALANCE are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.1 | \nSiemens | \nSiemens SCALANCE | \nMissing Authentication for Critical Function, Improper Authentication, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Validation of Integrity Check Value, Improper Input Validation, Out-of-bounds Read, Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Authorization, Allocation of Resources Without Limits or Throttling, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | \n
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Mitigation
Disable A-MSDU, if possible
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n3.5 | \nLOW | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | \n
An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-287 Improper Authentication
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-354 Improper Validation of Integrity Check Value
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
\n\nMitigation
As these vulnerabilities can only be exploited within Wi-Fi range, when possible reduce Wi-Fi transmission power or make sure to have the devices in private areas with physical access controls
Vendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N | \n
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.4 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H | \n
The BN_mod_sqrt() function in openSSL, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | \n
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C | \n
Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C | \n
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | \n
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.
\n\nVendor fix
Update to V6.6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109996102/
Relevant CWE: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-019200 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-019200 advisory | \n
Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow remote code execution.
\nThe following versions of Hardy Barth Salia EV Charge Controller are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.3 | \nHardy Barth | \nHardy Barth Salia EV Charge Controller | \nUnrestricted Upload of File with Dangerous Type | \n
A vulnerability was found in eCharge Hardy Barth Salia PLCC 2.3.81. It has been declared as critical. This vulnerability affects unknown code of the file /firmware.php of the component Web UI. The manipulation of the argument media leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
\n\nMitigation
Hardy Barth did not respond to CISA's request for coordination.
Mitigation
Contact Hardy Barth using their contact page here: https://www.hardy-barth.de/de/kontakt for more information.
https://www.hardy-barth.de/de/kontakt
Mitigation
Alternatively, Hardy Barth can also be contacted through their eCharge brand here: https://www.echarge.de/en/contact_company
https://www.echarge.de/en/contact_company
Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | \n
A security flaw has been discovered in eCharge Hardy Barth Salia PLCC 2.3.81. This issue affects some unknown processing of the file /api.php. The manipulation of the argument setrfidlist results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
\n\nMitigation
Hardy Barth did not respond to CISA's request for coordination.
Mitigation
Contact Hardy Barth using their contact page here: https://www.hardy-barth.de/de/kontakt for more information.
https://www.hardy-barth.de/de/kontakt
Mitigation
Alternatively, Hardy Barth can also be contacted through their eCharge brand here: https://www.echarge.de/en/contact_company
https://www.echarge.de/en/contact_company
Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-21 | \n1 | \nInitial Publication | \n
Siemens SINEC NMS when used with User Management Component (UMC) contains an authentication bypass vulnerability due to insufficient validation of user identity. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
\nThe following versions of Siemens SINEC NMS are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.3 | \nSiemens | \nSiemens SINEC NMS | \nImproper Verification of Cryptographic Signature | \n
The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)
\n\nVendor fix
Update to V4.0 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000760/
Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-801704 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-801704 advisory | \n
Successful exploitation of this vulnerability could allow an attacker to pair via Bluetooth with a motorcycle, gaining unauthorized access to all Bluetooth functions, including changing the firmware.
\nThe following versions of Zero Motorcycles Firmware are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.4 | \nZero Motorcycles | \nZero Motorcycles Firmware | \nKey Exchange without Entity Authentication | \n
Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.
\n\nMitigation
Zero Motorcycles has investigated this report and cautions users to pair their mobile device to their vehicle in a safe location where they can be sure no one else will try to pair at the same time. Once initiated, complete the full pairing process and confirm it is successful. Store physical keys in a secure location and do not leave the bike unattended with the key in the \"ON\" position. Zero Motorcycles plans to address this issue in a firmware update scheduled for release in May 2026. Update the firmware to the latest available version.
Relevant CWE: CWE-322 Key Exchange without Entity Authentication
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.4 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-21 | \n1 | \nInitial Publication | \n
SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
\nThe following versions of Siemens SINEC NMS are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nSiemens | \nSiemens SINEC NMS | \nAuthorization Bypass Through User-Controlled Key | \n
Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.
\n\nMitigation
Limit network access to trusted users and systems only
Vendor fix
Update to V4.0 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000760/
Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-605717 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-605717 advisory | \n
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens Industrial Edge Management are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.1 | \nSiemens | \nSiemens Industrial Edge Management | \nAuthentication Bypass by Primary Weakness | \n
Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.
\n\nMitigation
Ensure network access to affected products is limited to trusted parties only
Vendor fix
Update to V1.15.17 or later version
https://iehub.eu1.edge.siemens.cloud/
Vendor fix
Update to V2.1.1 or later version
https://iehub.eu1.edge.siemens.cloud/
Vendor fix
Update to V2.8.0 or later version
https://iehub.eu1.edge.siemens.cloud/
Relevant CWE: CWE-305 Authentication Bypass by Primary Weakness
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-609469 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-609469 advisory | \n
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains a vulnerability that could allow an attacker to achieve arbitrary code execution and to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
\nThe following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.7 | \nSiemens | \nSiemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) | \nNumeric Truncation Error | \n
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
\n\nVendor fix
Update to V5.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000841/
Relevant CWE: CWE-197 Numeric Truncation Error
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.7 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-225816 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nPublication Date | \n
| 2026-04-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-225816 advisory | \n
CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nThe Cybersecurity and Infrastructure Security Agency (CISA) is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm).1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments.
\nOn March 31, 2026, two npm packages for versions axios@1.14.1 and axios@0.30.4 of Axios npm injected the malicious dependency plain-crypto-js@4.2.1 that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.2
CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise:\u202f
\nnpm install or npm update with the compromised Axios version.\nIf compromised dependencies are identified, revert the environment to a known safe state.
\naxios@1.14.0 or axios@0.30.3 and delete node_modules/plain-crypto-js/.npm install or npm update.\nSfrclak[.]com domains.In addition, CISA recommends organizations using Axios npm:
\nignore-scripts=true in the .npmrc configuration file, which prevents potentially malicious scripts from executing during npm install packages.min-release-age=7 in the .npmrc configuration file to only install packages that have been published for at least seven days, which helps avoid installation of packages that may not be completely vetted or are potentially malicious.See the following resources for additional guidance on this compromise:
\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
\n1 \u201cPost Mortem: axios npm supply chain compromise,\u201d axios GitHub, Issue #10636, March 31, 2026, https://github.com/axios/axios/issues/10636.
\n2 \u201cMitigating the Axios npm supply chain compromise,\u201d Microsoft Threat Intelligence and Microsoft Defender Security Research Team, April 1, 2026, https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/.
\nSuccessful exploitation of this vulnerability could allow an unauthenticated attacker to modify simulation parameters, training configuration and training records.
\nThe following versions of AVEVA Pipeline Simulation are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.1 | \nAVEVA | \nAVEVA Pipeline Simulation | \nMissing Authorization | \n
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.
\n\nVendor fix
All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher. (https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f)
https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f
Mitigation
For more information, please see AVEVA's security bulletin AVEVA-2026-004 (https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf).
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf
Vendor fix
Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the Pipeline Simulation Server API to ensure that only trusted Pipeline Simulation client systems are permitted to establish connections.
Mitigation
Enforce Secure Communication: Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of manipulator-in-the-middle(MitM) attacks and tampering with data in transit.
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-16 | \n1 | \nInitial Republication of AVEVA-2026-004 | \n
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.
\nThe following versions of Delta Electronics ASDA-Soft are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nDelta Electronics | \nDelta Electronics ASDA-Soft | \nStack-based Buffer Overflow | \n
A stack-based buffer overflow vulnerability is triggered in ASDA-Soft version 7.2.0.0 during the parsing of malformed .par files.
\n\nVendor fix
Delta Electronics recommends users download and upgrade ASDA-Soft to v7.2.6.0 or later. If you have any product-related support concerns, contact Delta via the portal page at https://www.deltaww.com/en-US/service-support/contact-us?type=1 for any information or materials you may require.
https://www.deltaww.com/en-US/service-support/contact-us?type=1
Mitigation
Delta Electronics provides the following general recommendations: Do not click on untrusted internet links or open unsolicited attachments in emails. Avoid exposing control systems and equipment to the Internet. Place control system networks and remote devices behind firewalls, and isolate them from the business network. When remote access is required, use a secure access method, such as a virtual private network (VPN).
Mitigation
For more information, see Delta Electronics advisory Delta-PCSA-2026-00007 athttps://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00007_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerability%20(CVE-2026-5726).pdf
https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00007_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerability%20(CVE-2026-5726).pdf
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to systems and services.
\nThe following versions of Horner Automation Cscape and XL4, XL7 PLC are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.1 | \nHorner Automation | \nHorner Automation Cscape and XL4, XL7 PLC | \nWeak Password Requirements | \n
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
\n\nVendor fix
Horner Automation recommends users update to Cscape v10.2 SP2 or later. Horner Automation has also released the latest firmware for both XL4 and XL7 PLCs. Horner recommends users update to the latest version of the firmware. https://hornerautomation.com/cscape-software-free/cscape-software/.
https://hornerautomation.com/cscape-software-free/cscape-software/
Mitigation
For more information, see Horner Automation's release notes.
Relevant CWE: CWE-521 Weak Password Requirements
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-16 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow attackers to conduct reconnaissance, capture or decrypt sensitive data, alter device configurations, gain unauthorized administrative or root\u2011level access, execute arbitrary code, compromise credentials or communications, and ultimately obtain full control over affected devices.
\nThe following versions of Anviz Multiple Products are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nAnviz | \nAnviz Multiple Products | \nMissing Authorization, Missing Authentication for Critical Function, Improper Neutralization of Special Elements used in a Command ('Command Injection'), Download of Code Without Integrity Check, Use of Hard-coded Cryptographic Key, Relative Path Traversal, Cleartext Transmission of Sensitive Information, Improper Verification of Source of a Communication Channel, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') | \n
CX7 is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
CX7 is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational imagery.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root\u2011level access.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-494 Download of Code Without Integrity Check
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
CX7 is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.7 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | \n
CX7 is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug\u2011setting changes.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-23 Relative Path Traversal
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.9 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | \n
CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on\u2011path attackers to sniff credentials and session data, which can be used to compromise the device.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | \n
CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-940 Improper Verification of Source of a Communication Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | \n
CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.
\n\nMitigation
Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.
https://www.anviz.com/contact-us.html
Relevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-16 | \n1 | \nInitial Publication | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Thu, 16 Apr 26 12:00:00 +0000", "last_updated": "Thu, 16 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog", "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog", "summary": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Tue, 14 Apr 26 12:00:00 +0000", "last_updated": "Tue, 14 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "title": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "summary": "CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Mon, 13 Apr 26 12:00:00 +0000", "last_updated": "Mon, 13 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-01", "title": "Contemporary Controls BASC 20T", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-01", "summary": "\nSuccessful exploitation of this vulnerability could allow an attacker to enumerate the functionality of each component associated with the PLC, reconfigure, rename, delete, perform file transfers, and make remote procedure calls.
\nThe following versions of Contemporary Controls BASC 20T are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nContemporary Controls Sedona Alliance | \nContemporary Controls BASC 20T | \nReliance on Untrusted Inputs in a Security Decision | \n
An attacker could use data obtained by sniffing the network traffic to forge packets in order to make arbitrary requests to Contemporary Controls BASC 20T.
\n\nMitigation
According to Contemporary Controls, the BASC-20T is an obsolete product. It is recommended that users of the affected product contact Contemporary Controls for additional information.
https://www.ccontrols.com/support/contacttech.htm
Relevant CWE: CWE-807 Reliance on Untrusted Inputs in a Security Decision
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-09 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow a low privileged remote attacker to manipulate register values, which would result in too much or too little odorant being injected into a gas line.
\nThe following versions of GPL Odorizers GPL750 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.6 | \nGPL Odorizers | \nGPL Odorizers GPL750 | \nMissing Authentication for Critical Function | \n
A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.
\n\nMitigation
GPL Odorizers recommends users update to the latest software version of the GPL750 in connection with the latest firmware from Horner Automation for the XL4, XL4 Prime, XL7, and XL7 Prime devices.https://lincenergysystems-my.sharepoint.com/:f:/p/h_baer/IgDYaHIhXpyLQJvnKPd6b80TAUgV7Lp8qmVYBFUb0lmr7ak?e=JLeADm.
https://lincenergysystems-my.sharepoint.com/:f:/p/h_baer/IgDYaHIhXpyLQJvnKPd6b80TAUgV7Lp8qmVYBFUb0lmr7ak?e=JLeADm
Mitigation
GPL Odorizers recommends users clear the old files from their microSD cards, keeping only the LOGS folder and the FIRMWARE.LIC file if they have a WebMI license. The compressed folder downloaded from the link above can then be extracted to the root directory of the microSD card. These files already include the corresponding firmware update. If users do not have IT permissions to access their microSD cards, GPL Odorizers can provide preconfigured SD cards that technicians can simply swap into their odorizers prior to installation.
Mitigation
For assistance in updating GPL Odorizers to the latest version, users should reach out to GPL Odorizers directly via phone number (303) 697-6701 during the hours of 8:00 a.m. to 4:00 p.m. MST.
Mitigation
Horner Automation offers firmware version 15.76 for their XL Series and version 17.30 for their XL Prime Series controllers https://hornerautomation.com/controller-firmware/. An installation guide is available for both the XL series and the XL Prime series.
https://hornerautomation.com/controller-firmware/
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-09 | \n1 | \nInitial Publication | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Wed, 08 Apr 26 12:00:00 +0000", "last_updated": "Wed, 08 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-097-01", "title": "Mitsubishi Electric GENESIS64 and ICONICS Suite products", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-097-01", "summary": "\nSuccessful exploitation of these vulnerabilities could allow a local attacker to disclose SQL Server credentials used by the affected products and use them to disclose, tamper with, or destroy data, or to cause a denial-of-service (DoS) condition on the system.
\nThe following versions of Mitsubishi Electric GENESIS64 and ICONICS Suite products are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nMitsubishi Electric | \nMitsubishi Electric GENESIS64 and ICONICS Suite products | \nCleartext Storage of Sensitive Information, Cleartext Storage of Sensitive Information in GUI | \n
When the local caching feature using SQLite is enabled and SQL authentication is used for the SQL Server authentication, the SQL Server credentials are stored in plaintext within the local SQLite file. This results in a vulnerability due to Cleartext Storage of Sensitive Information (CWE 312), which may lead to information disclosure, tampering, or denial of service (DoS).
\n\nVendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. After installation, perform the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\Cache\\*.sdf\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\".
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. After installation, perform the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\Cache\\*.sdf\". For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".
https://iconics.com/about/security/cert
Vendor fix
Mitsubishi Electric is releasing fixed version 11.03 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. After installation, perform the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\11\\Cache\\*.sqlite3\". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\".
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.03 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. After installation, perform the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\11\\Cache\\*.sqlite3\". For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".
https://iconics.com/about/security/cert
No fix planned
There are no plans to release fixed version for MC Works64. For users of MC Works64, refer to the Mitsubishi Electric security advisory \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\", and take the actions described there.
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Mitigation
For customer of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\Cache\\*.sdf\".
Mitigation
For customer of GENESIS that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following step (1) and (2). (1) In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\11\\Cache\\*.sqlite3\".
Mitigation
For customer of MC Works 64, Mitsubishi Electric recommends performing the following step (1) and (2). (1)In Workbench, open the \u201cConfigure Application(s) Settings\u201d dialog. In the \u201cAvailable Applications\u201d list, uncheck the \u201cLocal Cache\u201d column for applications. (2) Delete the files created by the local cache functionality from \"C:\\ProgramData\\ICONICS\\Cache\\*.sdf\".
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using Windows authentication instead of SQL authentication for the SQL server authentication method, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and to the network to which the PC is connected, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
In the Hyper Historian Splitter feature of the affected products, when SQL authentication is used for the SQL Server authentication, the SQL Server credentials are displayed in plain text in the GUI. This results in a vulnerability due to Cleartext Storage of Sensitive Information in GUI (CWE\u2011317 ), which may lead to information disclosure, tampering, or denial\u2011of\u2011service (DoS).
\n\nVendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\".
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".
https://iconics.com/about/security/cert
Vendor fix
Mitsubishi Electric is releasing fixed version 11.03 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\".
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.03 or later for GENESIS. Please download the fixed version from the link \"https://iconicsinc.my.site.com/community/s/resource-center/product-downloads\" and install it. For more information on the fixed version, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities which can be found at \"https://iconics.com/about/security/cert\".
https://iconics.com/about/security/cert
No fix planned
There are no plans to release fixed version for MC Works64. For users of MC Works64, refer to the Mitsubishi Electric security advisory \"https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf\", and take the actions described there.
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf
Mitigation
For customer of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps (1) and (2). (1) Change the permissions of HHSplitter.exe so that only trusted administrators can execute it. (2) Delete HHSplitter.exe from the system if it is unnecessary.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using Windows authentication instead of SQL authentication for the SQL server authentication method, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, and from non-administrator users, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploiting this vulnerability.
Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
Relevant CWE: CWE-317 Cleartext Storage of Sensitive Information in GUI
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Mitsubishi Electric V20251021-001, V20251029-001 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact CISA directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-07 | \n1 | \nInitial Publication | \n
| 2026-04-07 | \n2 | \nInitial CISA Republication of CISA V20251021-001, V20251029-001 advisory | \n
| Title | \nIranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | \n
|---|---|
| Original Publication | \nApril 7, 2026 | \n
| Executive Summary | \n\n Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss. \nU.S. organizations should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of this advisory to reduce the risk of compromise. \n | \n
| Affected Products | \n\n
| \n
| Key Actions | \n\n
| \n
| Indicators of Compromise | \n\n For a downloadable copy of IOCs, see: \n
| \n
| Intended Audience | \n\n Organizations: Critical Infrastructure \nSectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy \nRoles: Defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer \n | \n
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), and United States Cyber Command \u2013 Cyber National Mission Force (CNMF), hereafter referred to as the \u201cauthoring agencies,\u201d are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected operational technology (OT) devices, including Rockwell Automation/Allen-Bradley-manufactured programmable logic controllers (PLCs), across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with the project files1 and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity has resulted in operational disruption and financial loss.
\nDue to the widespread use of these PLCs and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section to reduce the risk of compromise.
\nThe authoring agencies assess a group of Iranian-affiliated advanced persistent threat (APT) actors is conducting this activity to cause disruptive effects within the United States. The group has targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors. The authoring agencies previously reported on similar activity targeting PLCs by CyberAv3ngers (aka Shahid Kaveh Group)\u2014a cyber threat actor affiliated with Iran\u2019s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).
\nIf owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see Contact Information) to receive support, mitigation, and investigation assistance, and engage your cyber incident response plans.
\nIn addition to contacting the authoring agencies, organizations with Rockwell Automation/Allen-Bradley-manufactured PLCs should review the manufacturer\u2019s previously issued guidance to strengthen the security of their operational technology deployments: PN1550 | CVE-2021-22681: Authentication Bypass Vulnerability Found in Logix Controllers, published in 2021, and SD1771 | Rockwell Automation Reiterates Customer Guidance to Disconnect Devices from the Internet and Harden PLCs to Protect from Cyber Threats, published in 2026. Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at PSIRT@rockwellautomation.com for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.
\nFor more information on Iranian malicious cyber activity, see CISA\u2019s Iran Threat Overview and Advisories webpage and the FBI\u2019s Iran Threat webpage.
\nDownload the PDF version of this report:
\n\n\n\n\n\nFor a downloadable copy of IOCs, see:
\n\n\n\n\n\nDuring a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as \"CyberAv3ngers\u201d targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including WWS. For more information on this group\u2019s activity, see the authoring agencies\u2019 Joint Cybersecurity Advisory IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.
\nThe FBI assesses a group of Iranian-affiliated APT actors are targeting internet-exposed PLCs with the intent to cause disruptions\u2014including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays\u2014to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. organizations have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.
\nSince at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT-group that disrupted the function of PLCs. These PLCs were deployed across multiple U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy sectors) within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.
\nNote: This advisory uses the MITRE ATT&CK\u00ae Matrix for Enterprise framework, version 18. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables of the threat actors\u2019 activity mapped to MITRE ATT&CK tactics and techniques.
\nThe authoring agencies observed Iranian-affiliated APT actors using several overseas-based IP addresses to access internet-facing Rockwell Automation/Allen-Bradley-manufactured PLCs [T0883]. The actors used leased, third-party hosted infrastructure with configuration software, such as Rockwell Automation\u2019s Studio 5000 Logix Designer software, to create an accepted connection to the victim\u2019s PLC. Targeted devices include CompactLogix and Micro850 PLC devices.
\nInbound malicious traffic may be directed to devices on any of following ports: 44818, 2222, 102, 22, or 502. The targeting of ports [T0885] associated with other OT vendors\u2019 protocols suggests these actors may also be targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including the Siemens S7 PLC. Additionally, the actors deployed Dropbear Secure Shell (SSH) software on victim endpoints to enable them to gain remote access through port 22 [T1219].
The FBI identified that this activity resulted in the extraction of the device\u2019s project file and data manipulation on HMI and SCADA displays [T1565].
\nSee Table 1 for recent IP addresses used by the Iranian-affiliated APT actors to communicate with Rockwell Automation/Allen-Bradley-manufactured devices (and potentially other branded OT devices) in the United States.
\nDisclaimer: The FBI observed that the threat actors used the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.
\nSee Table 2 to Table 4 for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK\u2019s Best Practices for MITRE ATT&CK Mapping and CISA\u2019s Decider Tool.
\n| Technique Title | \nID | \nUse | \n
|---|---|---|
| Internet Accessible Device | \nT0883 | \nThe actors used Rockwell Automation\u2019s programming software (such as Studio 5000 Logix Designer) to access and interact with publicly exposed, internet-accessible PLCs installed and deployed without sufficient network and/or hardening security controls. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Stored Data Manipulation | \nT1565 | \nThe actors maliciously interacted with project files and altered data displayed on HMI and SCADA displays | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Commonly Used Port | \nT0885 | \nThe actors used commonly used OT ports to communicate with PLCs. | \n
| Remote Access Tools | \nT1219 | \nThe actors deployed Dropbear SSH software on victim endpoints to enable them to gain remote access through port 22. | \n
The authoring agencies recommend organizations implement the mitigations below to improve your organization\u2019s cybersecurity posture on the basis of the threat actors\u2019 activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals 2.0 (CPGs 2.0) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA\u2019s CPG 2.0 webpage for more information on the CPGs, including additional recommended baseline protections.
\nThe cyber threat actors accessed Rockwell Automation/Allen-Bradley-manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.
\nIn addition, organizations with these PLCs should view Rockwell Automation\u2019s guidance: Rockwell Automation Reiterates Customer Guidance to Disconnect Devices from the Internet and Harden PLCs to Protect from Cyber Threats.
\nImmediate steps to prevent the attack:
\nFollow-up steps to strengthen security posture:
\nIn addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:
\nNote: The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced in this product do not offer such security features.
\nAlthough critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products that are secure by design and default. The authoring agencies urge device manufacturers to take ownership of their customers\u2019 security outcomes by following the principles in the joint guide Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products, primarily:
\nBy using secure by design tactics, software manufacturers can make product lines secure \u201cout of the box\u201d without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.
\nFor more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. For more information on secure by design, see CISA\u2019s Secure by Design webpage and joint guide.
\nIn addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
\nTo get started:
\nThe authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
\nU.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:
\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. The authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring agencies.
\nApril 7, 2026: Initial version.
\n1Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.
\n2 See CompactLogix 5370 Controllers (Chapter 5: \"Select the Operating Mode of the Controller\") for more information on functions available for the switch.
", "summary_is_html": true, "first_seen": "Tue, 07 Apr 26 12:00:00 +0000", "last_updated": "Tue, 07 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Mon, 06 Apr 26 12:00:00 +0000", "last_updated": "Mon, 06 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-01", "title": "Siemens SICAM 8 Products", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-01", "summary": "\nMultiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE - RTUM85 Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens SICAM 8 Products are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nSiemens | \nSiemens SICAM 8 Products | \nAllocation of Resources Without Limits or Throttling, Out-of-bounds Write | \n
The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.
\n\nVendor fix
Update to V26.10 or later version The firmware RTUM85 V26.10 is present within \u201cCP-8010/CP-8012 Package\u201d V26.10 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.10 https://support.industry.siemens.com/cs/document/109818240
Vendor fix
Update to V26.10 or later version The firmware CPCI85 V26.10 is present within \u201cCP-8031/CP-8050 Package\u201d V26.10 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.10 https://support.industry.siemens.com/cs/document/109972536/
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
The affected application contains an out-of-bounds write vulnerability while parsing specially crafted XML inputs. This could allow an unauthenticated attacker to exploit this issue by sending a malicious XML request, which may cause the service to crash, resulting in a denial-of-service condition.
\n\nVendor fix
Update to V26.10 or later version The firmware CPCI85 V26.10 is present within \u201cCP-8031/CP-8050 Package\u201d V26.10 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.10 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.10.0 or later version The firmware SICORE V26.10.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.10 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.10 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-246443 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-03-26 | \n1 | \nPublication Date | \n
| 2026-04-02 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-246443 advisory | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
", "summary_is_html": true, "first_seen": "Thu, 02 Apr 26 12:00:00 +0000", "last_updated": "Thu, 02 Apr 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-02", "title": "Yokogawa CENTUM VP", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-02", "summary": "\nSuccessful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.
\nThe following versions of Yokogawa CENTUM VP are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 4 | \nYokogawa | \nYokogawa CENTUM VP | \nUse of Hard-coded Password | \n
Affected products contain a hardcoded password for the user account (PROG) used for CENTUM Authentication Mode within the system. Under the following conditions, there is a risk that an attacker could log in as the PROG user. The default permission for the PROG users is S1 permission (equivalent to OFFUSER). Therefore, for properly permission-controlled targets of operation and monitoring, even if an attacker logs in as the PROG user, the risk of critical operations or configuration changes being performed is considered low. If the PROG user's permissions have been changed for any reason, there is a risk that operations or configuration changes may be performed under the modified permissions. Additionally, exploiting this vulnerability requires an attacker to already have access to the HIS screen controls.
\n\nMitigation
Yokogawa recommends users applying the following mitigations to affected versions:
Vendor fix
CENTUM VP R5.01.00 to R5.04.20: Change the user authentication mode to Windows Authentication Mode.
Vendor fix
CENTUM VP R6.01.00 to R6.12.00: Change the user authentication mode to Windows Authentication Mode.
Vendor fix
CENTUM VP R7.01.00: Apply patch software R7.01.10.
Mitigation
NOTE:Changing to Windows Authentication Mode requires engineering work. If users wish to make this change, please contact Yokogawa directly https://contact.yokogawa.com/cs/gw?c-id=000498.
https://contact.yokogawa.com/cs/gw?c-id=000498
Mitigation
For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0003 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0003-E.pdf
https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0003-E.pdf
Relevant CWE: CWE-259 Use of Hard-coded Password
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-02 | \n1 | \nInitial Republication of YSAR-26-0003 | \n