CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.

Filters

1 active

Reset filters

Search: VDE-2025-085

Vendor

Protocol

Sector

Severity

Source

1 advisories found

VDE-2025-085

Welotec: Path Traversal in SmartEMS Upload Handling

Welotec — SmartEMS

Welotec PSIRThigh

Published

10 September 2025

Last update

22 September 2025

Linked CVEs

CVE-2025-41714

Affected sectors

Risk evaluation

A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.

Mitigation summary

Restrict access to the SmartEMS Web UI to trusted admin networks/VPN. Enforce strong credentials and rotate or revoke active tokens/sessions.

Revision history (2)

Initial publication — 10 September 2025
Initial revision.
Update A — 22 September 2025
Changes impact note categorie from details to description

Official source: Welotec PSIRT