CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 03:07.

Filters

1 active

Reset filters

Search: VDE-2024-004

Vendor

Protocol

Sector

Severity

Source

1 advisories found

VDE-2024-004

TRUMPF: Multiple products affected by log4net vulnerability

TRUMPF — TruTops Boost

TRUMPF PSIRTcritical

Published

22 April 2025

Last update

22 May 2025

Linked CVEs

CVE-2018-1285

Affected sectors

Risk evaluation

The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

Mitigation summary

New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

Revision history (2)

Initial publication — 22 April 2025
Initial version
Update A — 22 May 2025
Fix: added distribution, quotation mark

Official source: TRUMPF PSIRT