ICS Advisories

Risk evaluation

Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

Mitigatiesamenvatting

Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.

Risk evaluation

SICK identified multiple products affected by the Brotli vulnerability, also known as Broccoli2Shell (CVE-2026-111497). Successful exploitation of this vulnerability could impact the confidentiality, integrity, and availability of affected systems. At the time of publication, SICK is not aware of any active exploitation of this vulnerability targeting SICK products. SICK strongly recommends that customers review and implement the remediation measures provided in this advisory to reduce potential security risks.

Mitigatiesamenvatting

Users are recommended to re-install or upgrade to version 2026.1.3 while setting the global.imagePullPolicy to 'IfNotPresent'.

Risk evaluation

ABB is aware of public reports of vulnerabilities in third-party components (PHP and NTFS-3G) included in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities may insert and run arbitrary code on affected products. No active exploitations of the vulnerabilities have been reported to ABB by the time of writing this document. ABB will inform affected customers if this changes.

Mitigatiesamenvatting

For the products and version numbers listed below, please apply the relevant software patches according to the instructions provided by your ABB contact. - IPEC iSM Local Server: Debian 11 (Bullseye) - IPEC iSM Local Server: Debian 12 (Bookworm) - IPEC iSM Local Server: Debian 13 (Trixie) If further support is required to install the patches, please contact IPEC Sales (ipec.sales@gb.abb.com). Installation support may be chargeable where not covered by your existing warranty, maintenance or support agreement. ABB recommends that customers apply the update as soon as possible.

Risk evaluation

ABB is aware of publicly reported information concerning recently disclosed PHP vulnerabilities that impact the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability may insert and run arbitrary code on affected products.

Mitigatiesamenvatting

The problem is corrected in the following software release packages published for products: - Netcon 200 (GWDD-A03): Software release A103.03.020 published Nov-2-2026 ABB recommends that customers apply the update at earliest convenience. The process to install updates and identify the installed product version is described in the user manual and release note document attached to installation package.

Risk evaluation

On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Mitigatiesamenvatting

Update to V36.8.0 or later version

Risk evaluation

Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotli library is included in the IEM software stack, the affected functionality is not used or exposed. The same applies to IEDK. - Management Applications installed: Follow the specific mitigations until a fix is available. - Device Applications installed: Follow the specific mitigations until a fix is available. For Siemens-managed services, Industrial Edge Hub and Industrial Edge Management Cloud, appropriate Firewall/WAF protection has already been implemented. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

Mitigatiesamenvatting

Stop Common Configurator on Device (CC on Edge) until a fix is available

Risk evaluation

Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.

Mitigatiesamenvatting

Install patch 1.12.2 through the "Versions" page of the FactoryViews control panel on version 1.12.0 or 1.12.1. Versions of FactoryViews prior to 1.12 must first be updated to 1.12 available for download here: https://www.festo.com/de/de/support-portal-specific?query=factoryviews&groupId=4&productName=factoryviews&documentId=659952

Risk evaluation

Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.

Mitigatiesamenvatting

For customers using the affected products, please refer to Mitsubishi Electric's security advisory, "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf" and take the measures described there.

Risk evaluation

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals. Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.

Mitigatiesamenvatting

Currently no fix is planned

Risk evaluation

A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.

Mitigatiesamenvatting

The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.

Risk evaluation

This advisory addresses security vulnerabilities in Phoenix Contact products with an integrated CodeMeter Runtime, like PLCnext devices and Virtual Controls. These security vulnerabilities only may occur with versions <8.41a of the integrated software CodeMeter Runtime from Wibu-Systems. Please see listed products to determine which devices and firmware versions are affected.

Mitigatiesamenvatting

Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.

Risk evaluation

This advisory addresses multiple security vulnerabilities in Phoenix Contact products using the software CodeMeter Runtime like licensed desktop software tools. These security vulnerabilities only may occur with CodeMeter Runtime 8.x versions <V8.41a and CodeMeter Runtime 9.x versions <9.10 from Wibu-Systems.

Mitigatiesamenvatting

Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.

Risk evaluation

Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.

Mitigatiesamenvatting

Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.

Risk evaluation

GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.

Mitigatiesamenvatting

Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.

Risk evaluation

An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the product to stop, disclose process memory or insert and run arbitrary code.

Mitigatiesamenvatting

The problem is corrected by updating the Node.js runtime used by the product versions listed as affected. A new ABM release containing the patched runtime is not yet available; until then, the runtime must be updated manually: - Node.js 24.x (ABM 1.2, 1.2.1): Update to Node.js 24.22.1 or later within the 24.x line. This version has been successfully tested with the ABM standard. ABB recommends that customers apply the update at earliest convenience. Major-version changes require compatibility testing before a production restart. Where ASP.NET Core / .NET components are deployed together with ABM, ABB additionally recommends installing the vendor-patched .NET releases.

Risk evaluation

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

Mitigatiesamenvatting

Zie de officiële CISA-advisory voor mitigerende maatregelen.

Risk evaluation

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/CVE-2026-109618

Mitigatiesamenvatting

Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information.

Risk evaluation

SIMATIC IoT2050 devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Mitigatiesamenvatting

Harden the Node-RED installation (see Node-RED User Guide)

Risk evaluation

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.

Mitigatiesamenvatting

Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules.

Risk evaluation

B&R is aware of public reports of a vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities may insert and run arbitrary code on affected devices.

Mitigatiesamenvatting

The problem is corrected in the following product versions: - version line R4.4-01: APROL-AutoYaST-DVD-V4.4-010.12.261023-SLE15-SP6 - version line R4.4-65: APROL-AutoYaST-DVD-V4.4-650.4.261022-SLE15-SP7 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

Risk evaluation

ABB is aware of publicly reported information concerning recently disclosed PHP vulnerabilities that impact the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability may insert and run arbitrary code on affected products. As part of ABB product lifecycle policy, once a product transitions to obsolete state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing the mitigations de-fined in this document to reduce security risks.

Mitigatiesamenvatting

Mitigating factors describe conditions and circumstances that make an attack that exploits vulnerability difficult or less likely to succeed. - Obtain a private cellular Access Point (private APN). A dedicated private APN and the corresponding SIM card subscriptions can be obtained from your cellular service provider. This service does not expose traffic between remote sites and the main site to the Internet. Instead, communication is carried over the cellular operator’s private wide area network (WAN). Therefore, the ARM600 does not require any inbound ports to be exposed to the Internet. - Avoid exposing any system component directly to the Internet. If the ARM600 must be exposed to the Internet, only the VPN port should be accessible from the Internet. Patrol management connections can be configured to use a VPN tunnel, and remote administration can be performed using an PC OpenVPN client or another VPN solution that provides mutual authentication. - Establish Demilitarized Zone (DMZ) architecture, where the ARM600 server is deployed in the DMZ to terminate VPN connections from remote sites. The DMZ must be segregated from other networks by a firewall. - Configure the device firewall according to the allowlisting principle (i.e., explicitly allow only the required ports and protocols and block all other traffic). - Change the default user credentials of the ARM600 and Arctic wireless gateways, and use strong, non-guessable passwords that include special characters. Do not reuse passwords within the system.

Risk evaluation

Palo Alto Networks has published [1] information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/CVE-2026-111497

Mitigatiesamenvatting

Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information.

Risk evaluation

Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.

Mitigatiesamenvatting

Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. These measures reduce exposure to confirmed attack paths but are not a complete mitigation.

Risk evaluation

- General statement ABB became aware of vulnerabilities in ASPECT versions listed as affected in the advisory. The earliest report dates to Oct 2026. An attacker who successfully exploits these vulnerabilities may insert and run arbitrary code on affected products. ABB is currently investigating this vulnerability to provide adequate protection to customers. ASPECT is an on-premises Building Management System (BMS) that provides an additional option to be remotely accessible. - Statement on newly reported vulnerabilities ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers regarding this fact. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system's - and log-file-confidentiality, integrity and availability. ABB requires, as noted in previous security advisories and user documentation, that ASPECT should not be exposed to the Internet or any other unsecured network. Note: To exploit ASPECT, an attacker would need a misconfigured system. ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

Mitigatiesamenvatting

Please immediately do the following actions on any released SW version of ASPECT: - Stop and disconnect any ASPECT products that are exposed directly to the Internet, either via a direct ISP connection or via NAT port forwarding - Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks - Ensure log-files, downloaded from the equipment is protected against unauthorized access - Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage - When remote access is required, only use secure methods. If a Virtual Private Network (VPN) is used, ensure that the chosen VPN is secure i.e. updated to the most current version available and configured for secure access

Risk evaluation

Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Mitigatiesamenvatting

Disable IdP-initiated SSO