CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 14:22.
Filters
1 active1 advisories found
VDE-2022-003
BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology
Risk evaluation
By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.
Mitigation summary
Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.
Revision history (2)
Initial publication — 1 March 2022
Initial revision.
Update A — 5 June 2025
Fix: quotation mark