CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 01:34.

Filters

1 active

Reset filters

Search: VDE-2026-003

Vendor

Protocol

Sector

Severity

Source

1 advisories found

VDE-2026-003

Endress+Hauser: Multiple products prone to multiple vulnerabilities in e!Runtime and CODESYS V3 Runtime

Endress+Hauser — CC 100

Endress+Hauser PSIRThigh

Published

31 March 2026

Last update

1 April 2026

Linked CVEs

CVE-2022-47378 CVE-2022-47379 CVE-2022-47380 CVE-2022-47381 CVE-2022-47382 CVE-2022-47383 CVE-2022-47384 CVE-2022-47385 CVE-2022-47387 CVE-2022-47388 CVE-2022-47389 CVE-2022-47390 CVE-2022-47391 CVE-2022-47392 CVE-2022-47393

Affected sectors

Risk evaluation

Multiple Endress+Hauser devices are prone to vulnerabilities found in e!Runtime and the CODESYS V3 framework.

Mitigation summary

The CDC 90 device is not designed for network connectivity by default. Since it is not connected to a network, the vulnerabilities cannot be exploited. However, if the customer chooses to connect the device to a network, the default firewall settings should be maintained, as this will mitigate the security vulnerabilities. For the CC 100 and PFC 200 devices, ensure that the default firewall settings remain intact and that both PLC Runtime and PLC WebVisu are disabled. This configuration effectively mitigates the identified security vulnerabilities.

Revision history (2)

Initial publication — 31 March 2026
Initial version
Update A — 1 April 2026
Edited a typo in product tree.

Official source: Endress+Hauser PSIRT