CISA Advisories

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. The following versions of National Instruments LabView are affected: LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) LabVIEW (CVE-2025-64461, CVE-2025-64462, CVE-2025-64463, CVE-2025-64464, CVE-2025-64465, CVE-2025-64466, CVE-2025-64467, CVE-2025-64468, CVE-2025-64469) CVSS Vendor Equipment Vulnerabilities v3 7.8 National Instruments National Instruments LabView Out-of-bounds Write, Out-of-bounds Read, Use After Free, Stack-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Defense Industrial Base, Information Technology, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-64461 LabVIEW is vulnerable to an out-of-bounds write vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-787 Out-of-bounds Write Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64462 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::RGetMemFileHandle() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64463 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResource::DetachResource() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64464 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!VisaWriteFromFile() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64465 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!DataSizeTDR() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64466 LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!ExecPostedProcRecPost() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64467 LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::FindRsrcListEntry() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64468 LabVIEW is vulnerable to a use-after-free vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-416 Use After Free Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-64469 LabVIEW is vulnerable to a stack-based buffer overflow vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. View CVE Details Affected Products National Instruments LabView Vendor: National Instruments Product Version: National Instruments LabVIEW: <=2025_Q3, National Instruments LabVIEW: 2024, National Instruments LabVIEW: 2023, National Instruments LabVIEW: 2022, National Instruments LabVIEW: 2021 Product Status: known_affected Remediations Mitigation National Instruments recommends users apply the following mitigations to help reduce the risk: Vendor fix LabVIEW 2025: Upgrade to LabVIEW 2025 Q3 Patch 3 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2024: Upgrade to LabVIEW 2024 Q3 Patch 5 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2023: Upgrade to LabVIEW 2023 Q3 Patch 8 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2022: Upgrade to LabVIEW 2022 Q3 Patch 7 or later from NI Package Manager or Software Downloads Vendor fix LabVIEW 2021: Not in Mainstream Support Mitigation For more information refer to National Instruments security advisory. Relevant CWE: CWE-121 Stack-based Buffer Overflow Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Acknowledgments Michael Heinzl reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could result in a denial-of-service condition. The following versions of Rockwell Automation Micro820, Micro850, Micro870 are affected: Micro820 (CVE-2025-13823, CVE-2025-13824) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation Micro820, Micro850, Micro870 Dependency on Vulnerable Third-Party Component, Release of Invalid Pointer or Reference Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-13823 A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers. This issue occurs when the controllers received multiple malformed packets during fuzzing, causing a recoverable fault. View CVE Details Affected Products Rockwell Automation Micro820, Micro850, Micro870 Vendor: Rockwell Automation Product Version: Rockwell Automation Micro820: <=V14.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users of Micro820 V14.011 and prior update to newer Micro820 controllers (L20E V23.011 or later). Mitigation Rockwell Automation recommends users of Micro850/870 update to V12.013 or later. The update can be downloaded from the Rockwell Automation website. Mitigation For CVE-2025-13823, Rockwell Automation advises users to disable IPv6 functionalities if they do not require the feature. Mitigation Rockwell Automation users using the affected software, who are not able to upgrade to one of the corrected versions, should follow Rockwell Automation's security best practices. Mitigation For more information, please review Rockwell Automation's advisory. Relevant CWE: CWE-1395 Dependency on Vulnerable Third-Party Component Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-13824 A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with a solid red Fault LED and becomes unresponsive. Upon power cycling, the controller will enter a recoverable fault. View CVE Details Affected Products Rockwell Automation Micro820, Micro850, Micro870 Vendor: Rockwell Automation Product Version: Rockwell Automation Micro820: <=V14.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users of Micro820 V14.011 and prior update to newer Micro820 controllers (L20E V23.011 or later). Mitigation Rockwell Automation recommends users of Micro850/870 update to V12.013 or later. The update can be downloaded from the Rockwell Automation website. Mitigation Rockwell Automation users using the affected software, who are not able to upgrade to one of the corrected versions, should follow Rockwell Automation's security best practices. Mitigation For more information, please review Rockwell Automation's advisory. Relevant CWE: CWE-763 Release of Invalid Pointer or Reference Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Acknowledgments Rockwell Automation reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of these vulnerabilities could result in an attacker executing arbitrary code, executing a man-in-middle style attack, or bypass authentication. The following versions of Axis Communications Camera Station Pro, Camera Station, and Device Manager are affected: AXIS Camera Station Pro (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Camera Station (CVE-2025-30023, CVE-2025-30025, CVE-2025-30026) AXIS Device Manager (CVE-2025-30023, CVE-2025-30024, CVE-2025-30025) CVSS Vendor Equipment Vulnerabilities v3 9 Axis Communications Axis Communications Camera Station Pro, Camera Station, and Device Manager Deserialization of Untrusted Data, Improper Certificate Validation, Authentication Bypass Using an Alternate Path or Channel Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2025-30023 The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2025-30024 The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-295 Improper Certificate Validation Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2025-30025 The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58, Axis Communications AXIS Device Manager: <5.32 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Vendor fix AXIS Device Manager 5.32 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.2 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVE-2025-30026 The AXIS Camera Station Server had a flaw that allowed users to bypass authentication that is normally required. View CVE Details Affected Products Axis Communications Camera Station Pro, Camera Station, and Device Manager Vendor: Axis Communications Product Version: Axis Communications AXIS Camera Station Pro: <6.9, Axis Communications AXIS Camera Station: <5.58 Product Status: known_affected Remediations Mitigation Axis Communications recommends users to upgrade to the following versions: Vendor fix AXIS Camera Station Pro 6.9 or later Vendor fix AXIS Camera Station 5.58 or later Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Mitigation For more information on these issues, see the following security advisories from Axis: CVE-2025-30023, CVE-2025-30024, CVE-2025-30025, and CVE-2025-30026. Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.1 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L Acknowledgments Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could result in denial-of-service (DoS), information tampering, and information disclosure. The following versions of Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products are affected: GENESIS64 (CVE-2025-11774) ICONICS Suite (CVE-2025-11774) MobileHMI (CVE-2025-11774) MC Works64 (CVE-2025-11774) CVSS Vendor Equipment Vulnerabilities v3 8.2 Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan, United States Vulnerabilities Expand All + CVE-2025-11774 Malicious code execution vulnerability exists in the software keyboard function (hereinafter referred to as "keypad function") of ICONICS Suite, GENESIS64, MobileHMI, and MC Works64, which could lead to denial-of-service (DoS), information tampering, and information disclosure. An attacker may be able to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the keypad function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected produc is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE. View CVE Details Affected Products Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Product Version: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric GENESIS64: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric ICONICS Suite: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MobileHMI: <=10.97.2_CFR_3, Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric MC Works64: vers:all/* Product Status: known_affected Remediations Vendor fix Mitsubishi Electric Iconics Digital Solutions recommends users of GENESIS64, IONICS Suite, or MobileHMI upgrade to the GENESIS64 v10.97.3 or higher, or upgrade to the latest product, GENESIS V11, which all contain the fix for this vulnerability. Mitigation Version 10.97.3 can be downloaded by accessing Community Portal (https://iconicsinc.my.site.com/community) and navigating to "Resources > Product Downloads > 10.97.3." Vendor fix The latest patch version for GENESIS64 Version 10.97.3 can be downloaded from the link below: Mitigation https://iconicsinc.my.site.com/community/s/software-update/a35QQ000000y2oXYAQ/10973-critical-fixes-rollup-2 Vendor fix There are no plans to release a fixed version of MC Works64. Mitsubishi Electric recommends users of MC Works64 upgrade to the GENESIS64 v10.97.3 or higher. Mitigation Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommends users take the following mitigations to minimize the risk of exploiting this vulnerability: Mitigation Use the PCs with the affected product installed in the LAN and block remote login from untrusted networks, hosts and users. Mitigation Block unauthorized access by using a firewall or virtual private network (VPN), etc., and allow remote login only to trusted users when connecting the PCs with the affected product installed to the Internet. Mitigation Restrict physical access to the PC with the affected product installed and the network to which the PC is connected to prevent unauthorized physical access. Mitigation Do not click web links in emails from untrusted sources. Also, do not open attachments in untrusted emails. Mitigation Install an antivirus software in the PC with the affected product installed. Mitigation Refer to the Mitsubishi Electric Iconics Digital Solutions Whitepaper on Security Vulnerabilities, the most recent version of which can be found at: https://iconics.com/About/Security/CERT Mitigation Refer to the Mitsubishi Electric security advisory at: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf for information on the availability of the security updates. Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Acknowledgments Mitsubishi Electric Iconics Digital Solutions reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2025-12-18 Date Revision Summary 2025-12-18 1 Initial Republication Legal Notice and Terms of Use

CISA released nine Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-352-01 Inductive Automation Ignition ICSA-25-352-02 Schneider Electric EcoStruxure Foxboro DCS Advisor ICSA-25-352-03 National Instruments LabView ICSA-25-352-04 Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products ICSA-25-352-05 Siemens Interniche IP-Stack ICSA-25-352-06 Advantech WebAccess/SCADA ICSA-25-352-07 Rockwell Automation Micro820, Micro850, Micro 870 ICSA-25-352-08 Axis Communications Camera Station Pro, Camera Station, and Device Manager ICSA-24-291-03 Mitsubishi Electric CNC Series (Update C) CISA encourages users and administrators to review newly released ICS Advisories for technical details and mitigations.

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-20393 Cisco Multiple Products Improper Input Validation Vulnerability CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write encrypted traffic or perform a replay attack. The following versions of Johnson Controls PowerG, IQPanel and IQHub are affected: PowerG (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQHub (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 2+ (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) IQPanel 4 (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) CVSS Vendor Equipment Vulnerabilities v3 7.6 Johnson Controls Inc. Johnson Controls PowerG, IQPanel and IQHub Cleartext Transmission of Sensitive Information, Reusing a Nonce, Key Pair in Encryption, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Origin Validation Error Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2025-61738 The affected product is vulnerable due to cleartext transmission of sensitive information. This may allow an attacker to capture the network key and read or write encrypted packets on the PowerG network. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2025-61739 The affected product is vulnerable due to nonce reuse, which may allow an attacker to perform a replay attack or decrypt captured packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-26379 The affected product is vulnerable due to a weak pseudo-random number generator. This may allow an attacker to read or inject encrypted PowerG packets. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVE-2025-61740 The affected product is vulnerable to an authentication issue that does not verify the source of a packet. This could allow an attacker to create a denial-of-service condition or modify the configuration of the device. View CVE Details Affected Products Johnson Controls PowerG, IQPanel and IQHub Vendor: Johnson Controls Inc. Product Version: Johnson Controls Inc. PowerG: <=53.02, Johnson Controls Inc. IQHub: vers:all/*, Johnson Controls Inc. IQPanel 2: vers:all/*, Johnson Controls Inc. IQPanel 2+: vers:all/*, Johnson Controls Inc. IQPanel 4: <4.6.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following: Vendor fix Update IQPanel 4 to version 4.6.1/4.6.1i. Vendor fix Devices that support PowerG+ should use PowerG v53.05 or later. Mitigation During the installation or enrollment phase of setup, enter the PIN code in the PIN Code field on the sensor enrollment screen. For additional security, Johnson Controls recommends only authorized company personnel or integrators be present during the pairing process. Mitigation Replace all end-of-life products (IQ Panel 2, IQ Panel 2+, IQ Hub) with the latest IQ Panel 4 using firmware version 4.6.1 or greater. Mitigation For more detailed mitigation instructions, see Johnson Controls Product Security Advisory JCI-PSA-2025-01 at the Product Security Advisories page. Relevant CWE: CWE-346 Origin Validation Error Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.6 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Acknowledgments James Chambers and Sultan Qasim Khan of NCC Group reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities have been reported to CISA at this time. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could compromise the integrity of the product data and disrupt its availability. The following versions of Hitachi Energy AFS, AFR and AFF Series are affected: AFS 660-B/C/S (CVE-2024-3596) AFS 665-B/S (CVE-2024-3596) AFS 670 v2.0 (CVE-2024-3596) AFS 650 (CVE-2024-3596) AFS 655 (CVE-2024-3596) AFS 670 (CVE-2024-3596) AFS 675 (CVE-2024-3596) AFS 677 (CVE-2024-3596) AFR 677 (CVE-2024-3596) AFF 660 (CVE-2024-3596) AFF 665 (CVE-2024-3596) CVSS Vendor Equipment Vulnerabilities v3 9 Hitachi Energy Hitachi Energy AFS, AFR and AFF Series Improper Enforcement of Message Integrity During Transmission in a Communication Channel Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2024-3596 The RADIUS protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid response (access-accept, access-reject, or access-challenge) to any other response using a chosen-prefix collision attack against the MD5 response authenticator signature. View CVE Details Affected Products Hitachi Energy AFS, AFR and AFF Series Vendor: Hitachi Energy Product Version: Hitachi Energy AFS 660-B/C/S: vers:all/*, Hitachi Energy AFS 665-B/S: vers:all/*, Hitachi Energy AFS 670 v2.0: vers:all/*, Hitachi Energy AFS 650: vers:all/*, Hitachi Energy AFS 655: vers:all/*, Hitachi Energy AFS 670: vers:all/*, Hitachi Energy AFS 675: vers:all/*, Hitachi Energy AFS 677: vers:all/*, Hitachi Energy AFR 677: vers:all/*, Hitachi Energy AFF 660: vers:all/*, Hitachi Energy AFF 665: vers:all/* Product Status: known_affected Remediations Mitigation Hitachi Energy has identified the following recommended immediate actions: Mitigation All affected products: Set the RADIUS configuration to default which enables the RADIUS server message authenticator option. Vendor fix AFR 677, AFS 650, AFS 655, AFS 670, AFS 675, AFS 677: Command to enable Message Authenticator option: For AFS65x, AFS67x, AFR67x CLI: radius server msgauth MIB: hmAgentRadiusServerMsgAuth Vendor fix AFF 660, AFF 665, AFS 660-B/C/S, AFS 665-B/S, AFS 670: Command to enable Message Authenticator option: For AFS66x, AFS670 v2.0, AFF66x CLI: radius server auth modify msgauth MIB: hm2AgentRadiusServerMsgAuth Mitigation For more information, see the associated Hitachi Energy PSIRT security advisory 8DBD000230 RADIUS vulnerability in Hitachi Energy AFS, AFR and AFF series products. Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Acknowledgments Hitachi Energy reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Publication Legal Notice and Terms of Use

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker obtain plaintext credentials from the project file for GT Designer3, which could result in illegally operating GOT2000 and GOT1000 series devices. The following versions of Mitsubishi Electric GT Designer3 are affected: GT Designer3 Version1 (GOT2000) (CVE-2025-11009) GT Designer3 Version1 (GOT1000) (CVE-2025-11009) CVSS Vendor Equipment Vulnerabilities v3 5.1 Mitsubishi Electric Mitsubishi Electric GT Designer3 Cleartext Storage of Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan Vulnerabilities Expand All + CVE-2025-11009 Information Disclosure vulnerability due to Cleartext Storage of Sensitive Information(CWE-312) exists in GT Designer3. GT Designer3 stores credentials and verifies them in plain text, therefore an attacker may be able to obtain plaintext credentials from the project file for GT Designer3. As a result, the attacker may be able to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials. View CVE Details Affected Products Mitsubishi Electric GT Designer3 Vendor: Mitsubishi Electric Product Version: Mitsubishi Electric GT Designer3 Version1 (GOT2000): vers:all/*, Mitsubishi Electric GT Designer3 Version1 (GOT1000): vers:all/* Product Status: known_affected Remediations Mitigation Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting this vulnerability: Mitigation Use a personal computer with the affected product within the LAN and block remote login from untrusted networks, hosts, and users. Mitigation When connecting a personal computer with the affected product to the Internet, use a firewall, virtual private network (VPN), etc., to prevent unauthorized access and allow only trusted users to remote login. Mitigation Install an antivirus software on the computer using the affected product. Mitigation Don't open untrusted files or click untrusted links. Mitigation For more information, see Mitsubishi Electric's security advisory. Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.1 MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Acknowledgments Hea-Eun Moon and Junbeom Gwak of Red Alert Lab at NSHC reported this vulnerability to Mitsubishi Electric Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2025-12-16 Date Revision Summary 2025-12-16 1 Initial Republication Legal Notice and Terms of Use