ICS Advisories

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.

Mitigatiesamenvatting

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk evaluation

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.

Mitigatiesamenvatting

Update the myREX24V2 / myREX24V2.virtual instance to version 2.19.4.

Risk evaluation

A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.

Mitigatiesamenvatting

Please update your devices to the specified fixed firmware version. | Product | Fixed Version | |-------------------------------------------|---------------| | Lean Managed Switch 852-1812 | V1.2.1.S1 | | Lean Managed Switch 852-1813 | V1.2.1.S1 | | Lean Managed Switch 852-1813/000-001| V1.2.3.S1 | | Lean Managed Switch 852-1816 | V1.2.1.S1 | | Industrial Managed Switch 852-303 | V1.2.8.S1 | | Industrial Managed Switch 852-1305 | V1.2.0.S1 | | Industrial Managed Switch 852-1305/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505 | V1.1.9.S1 | | Industrial Managed Switch 852-602 | V1.0.6.S1 | | Industrial Managed Switch 852-603 | V1.0.6.S1 | | Industrial Managed Switch 852-1605 | V1.2.5.S1 | | Lean Managed Switch 852-1812/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-001| V1.2.1.S1 | | Lean Managed Switch 852-1816/010-000| V1.2.1.S1 |

Risk evaluation

Multiple vulnerabilities have been identified in the FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx firmware prior to version 3.53. One of these (CVE-2026-22317) enables an attacker to execute system commands as root user on the device. Five other vulnerabilities (CVE-2026-22316, CVE-2026-22318, CVE-2026-22319, CVE-2026-22320 and CVE-2026-22321) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2026-22322) relates to reflected cross-site scripting in the web-based management of the device. And one vulnerability (CVE-2026-22323) relates to Cross‑Site Request Forgery in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.53.

Mitigatiesamenvatting

Phoenix Contact strongly recommends to upgrade to firmware 3.53 which addresses this vulnerability and is available for download for all affected devices.

Risk evaluation

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Foxboro DCS Control Software on Foxboro DCS workstations and servers. Control Core Services and all runtime software, like FCPs, FDCs, and FBMs, are not affected. The [EcoStruxure™ Foxboro DCS](https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/) product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediation provided below may risk deserialization of untrusted data, which could result in loss of confidentiality, integrity and potential remote code execution on the compromised workstation.

Mitigatiesamenvatting

Version CS 8.1 of EcoStruxure™ Foxboro DCS includes a fix for this vulnerability and is available through https://buyautomation.se.com/ CS 8.1 requires FX-V3 licenses, standard upgrade procedures apply. A reboot is required for workstations and servers. Depending on the existing system version, online upgrade without production interruption might be possible. We recommend you work with your local Field Service Representative or Technical Service Consultant for further information.

Risk evaluation

The CODESYS Installer is affected by a privilege escalation vulnerability. Due to a race condition, a local attacker with limited privileges can replace the verified downloaded setup before execution. Because the update process runs with administrator privileges, a malicious application can be executed with elevated rights. The attack requires the legitimate user to confirm the self‑update prompt for the CODESYS Installer itself or to initiate an installation of a CODESYS Development System. The update process for CODESYS Add-Ons is not affected by this issue.

Mitigatiesamenvatting

Update the following product to version 2.6.1.0. * CODESYS Installer The CODESYS Installer as well as the CODESYS Development System can be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk evaluation

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems.Failure to apply the fix provided below may risk local arbitrary code execution, which could result in the local system being compromised, a disruption of operations, and/or unauthorized administrative control of the system.

Mitigatiesamenvatting

Hotfix_279338_Release_2024R2 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix. No reboot required.

Risk evaluation

Schneider Electric is aware of a vulnerability in its EcoStruxure Power Build Rapsody software. The [EcoStruxure Power Build Rapsody](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=2309) is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all devices, connection items, and mounting components. Failure to apply the mitigations/remediations provided below may risk memory corruption, heap-based buffer overflow, stack-based buffer overflow, which could result in local attackers being able to exploit these issues to potentially execute arbitrary code.

Mitigatiesamenvatting

Versions FR V2.8.1.0401, INT V2.8.6.200, and ES V2.8.5.0301 of EcoStruxure™ Power Build Rapsody includes a fix for the CVE-2025-13844 vulnerability and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=2309 Please restart the service after installing the new version.

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in Redis open-source database, affecting its Plant iT product. The [Plant iT/Brewmaxx](https://www.proleit.com/plant-it/) product is an object-oriented and PLC-based process control system with integrated Manufacturing Execution System functionality. The integrated and modular software platform consists of basic systems, modules and add-ons that can be flexibly combined. Failure to apply the remediations provided below may risk privilege escalation, which could result in remote code execution.

Mitigatiesamenvatting

Patch ProLeiT-2025-001 includes a fix to reduce the risk of exploit: • Install the patch to disable the eval commands in Redis on: o Application Server o VisuHub o Engineering Workstations o Workstation with emergency mode functionality • The patch ProLeiT-2025-001 is available via ProLeiT Support: https://www.proleit.com/support/ • Force usage of secure Redis configuration templates in system settings as documented in the patch manual. • Restart all patched Servers and Workstations

Risk evaluation

Schneider Electric is aware of a hard-coded credentials vulnerability in its EcoStruxure™ IT Data Center Expert (DCE) product that requires administrator credentials and enabling a feature (SOCKS Proxy) that is off by default. The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure, and remote compromise of the offer which could result in disruption of operations and access to system data.

Mitigatiesamenvatting

v9.1 of EcoStruxure™ IT Data Center Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/en/product-range/61851-ecostruxure-it-data-center-expert/#software-and-firmware

Risk evaluation

An unauthenticated remote attacker can exploit several vulnerabilities in Weidmueller devices Energy Meter 750-24 and Energy Meter 750-230 to ultimately gain full system access and remote code execution.

Mitigatiesamenvatting

Update to version 3.14

Risk evaluation

An unauthenticated remote attacker can exploit several vulnerabilities in Janitza UMG 96RM-E devices to ultimately gain full system access and remote code execution.

Mitigatiesamenvatting

It is strongly advised to update to the newest version. The vulnerabilities are fixed in version 3.14.

Risk evaluation

Two vulnerabilities affecting the SICK Lector85x and SICK Lector83x product families have been identified. Both vulnerabilities are caused by insufficient access restrictions in HTTP-based interfaces, which may allow unauthenticated access to sensitive device resources. Depending on the configuration, this could lead to unauthorized modification of device settings and security-relevant data. SICK recommends applying the defined remediations for both vulnerabilities. SICK is currently not aware of any public exploits.

Mitigatiesamenvatting

Users are strongly recommended to upgrade to release version 2.8.0.

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNECT24, mbNET HW1, and mbSPIDER products. CVE-2024-45275 affects only the mbNET HW1 product.

Mitigatiesamenvatting

**Note**: mbNET HW1 and mbSPIDER are EOL and will not receive any further updates.

Risk evaluation

Multiple vulnerabilities have been discovered in Helmholz products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the myREX24V2 and myREX24V2.virtual products. CVE-2024-45273 affects the REX 200/REX 250, myREX24V2, myREX24V2.virtual products. CVE-2024-45275 affects only the REX 200 / REX 250 products.

Mitigatiesamenvatting

**Note**: REX 300 is EOL and will not receive any further updates.

Risk evaluation

A vulnerability has been identified in WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser.

Mitigatiesamenvatting

Local access is required to exploit this vulnerability. To mitigate the risk, ensure that only authorized personnel have physical access to the device.

Risk evaluation

Two vulnerabilities affect the SICK LMS1000 and SICK MRS1000 product families. The vulnerabilities allow the use of weak cryptographic configurations in the SSH service, which may enable an attacker with network access to observe, manipulate, or compromise the integrity of SSH communications. SICK recommends applying the defined remediations for both vulnerabilities.

Mitigatiesamenvatting

Users are strongly recommended to upgrade to release version 2.4.1.

Risk evaluation

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

Mitigatiesamenvatting

Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

Risk evaluation

The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.

Mitigatiesamenvatting

It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.

Risk evaluation

The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

Mitigatiesamenvatting

New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

Risk evaluation

A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized configuration changes. Endress+Hauser has released a security update addressing this issue.

Mitigatiesamenvatting

If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.

Risk evaluation

A vulnerability has been disclosed in PLC ifm AC4xxS that allows an attacker to trigger the safety state with the help of a specially crafted html request. This leads to a loss of availability.

Mitigatiesamenvatting

When using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups. PLC with firmware V6.1.8 http interface can be disabled.

Risk evaluation

Eclipse Cyclone DDS has known vulnerabilities and is used in SICK picoScan150 and SICK picoScan120 products starting with version 2.2.0. A current analysis confirms that the identified vulnerabilities (CVE-2025-67109 and CVE-2023-24011) do not affect SICK picoScan150 and SICK picoScan120. Both vulnerabilities relate exclusively to certificate-based security features of ROS 2 / DDS, which are not supported on SICK picoScan150 and SICK picoScan120 devices and cannot be enabled by customers. At this time, there is no indication of any potential risk to SICK picoScan150 and SICK picoScan120 related to these two vulnerabilities.

Mitigatiesamenvatting

Zie de officiële CISA-advisory voor mitigerende maatregelen.

Risk evaluation

A vulnerability has been identified in the CODESYS Control runtime system, which includes an abstraction layer designed to ensure compatibility across different operating systems. This layer is used both by affected CODESYS products and by applications running on the PLC. The platform-specific adaptation of this abstraction layer for Linux and QNX contains a flaw in the SysSocket implementation. Due to incorrect internal handling and depending on how the caller interacts with the affected function, the issue can lead to an out-of-bounds read. An unauthenticated attacker may be able to exploit this vulnerability via socket-based communication, potentially causing a crash of the corresponding communication task. Additionally, also clients such as the PLCHandler running on Linux or QNX may be affected if they connect to a malicious server that triggers the flaw. Successful exploitation requires the attacker to win a race condition, which increases the complexity of the attack. Note: All platforms other than Linux and QNX are not affected.

Mitigatiesamenvatting

As the flaw resides in the SysSocketSelect() implementation, which has been switched to a poll()-based approach by default since version 3.5.21.0, the following setting can be added to the configuration file of the affected product (e.g., CODESYSControl.cfg) to revert to the select()-based implementation: [SysSocket] LinuxSelectPoll=1 Note: On Linux select() is limited to less than 1024 file descriptors.

Risk evaluation

A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a pointer of wrong type. Only CODESYS Control runtime systems and PLCs based on the CODESYS Runtime Toolkit that include the CmpVisuServer component are impacted. In the case of CODESYS Web Visu, the vulnerability can only be exploited if the web server is running. When the web server starts depends on the startup configuration: By default, it is only running if the PLC executes application code that includes a visualization.

Mitigatiesamenvatting

Update the following products to version 3.5.21.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.