CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 01:34.

Filters

1 active

Reset filters

Search: VDE-2021-044

Vendor

Protocol

Sector

Severity

Source

1 advisories found

VDE-2021-044

Endress+Hauser: Multiple products affected by log4net vulnerability

Endress+Hauser — DeviceCare

Endress+Hauser PSIRTcritical

Published

20 January 2022

Last update

14 May 2025

Linked CVEs

CVE-2017-5753

Affected sectors

Risk evaluation

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Mitigation summary

Make sure that no unauthorized access to the production environment is possible. Avoid using the above listed software with Windows administrator privileges if other users with lower privileges have access to the same software installation.

Revision history (3)

Initial publication — 20 January 2022
Initial revision.
Update A — 12 February 2025
Fix: corrected self-reference, fixed version
Update B — 14 May 2025
Fix: added distribution

Official source: Endress+Hauser PSIRT