ICS Advisories

Risk evaluation

A vulnerability in the CODESYS Control runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations. **Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.

Mitigatiesamenvatting

Update the following products to version 3.5.21.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. Following our general recommendation that the PKI should only be managed via the dedicated X.509 API or the corresponding online services of the CODESYS Control runtime system, the programmatic direct access via SysFile or SysDir operations or online access via the CODESYS file transfer services is denied after an update to a fixed product version. For compatibility reasons, the old behavior can be restored for applications that use these accesses via the following setting: [CmpOpenSSL] EnforceBlacklistOnPKIDir=0 However, we strongly recommend keeping the new default.

Risk evaluation

The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.

Mitigatiesamenvatting

Since August 8st, 2025, an automated configuration update is available for TRUMPF machines with a Telepresence Box 7.0.0 and newer. It will automatically be applied when activating a remote session from the machine. It is not necessary for a TRUMPF technician to join the session.

Risk evaluation

Start sequence for firewall service allows attack during the boot process. Password is reset to default when the device undergoes a firmware upgrade.

Mitigatiesamenvatting

Phoenix Contact strongly recommends upgrading affected charge controllers to firmware version 1.6.3 or higher which fixes these vulnerabilities.

Risk evaluation

Confidential data in HTTP query string of user requests. Incomplete sanitation of user input in administrative web interface.

Mitigatiesamenvatting

Read access to the device via administrative interfaces should be granted only to trustworthy users.

Risk evaluation

Critical vulnerabilities has been discovered in the product, mainly caused by ananonymous FTP server and Telnet access.The impact of the vulnerabilities on the affected device may result in Information disclosure Denial of service Device manipulation

Mitigatiesamenvatting

An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet. Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).

Risk evaluation

A stored cross-site scripting vulnerability has been discovered in the profinet gateway LB8122A.1.EL. An attacker can write an HTML tag with up to 32 characters in the message field of a HART transmitter. The HTML tag is interpreted as HTML when the HART information is displayed in a webbrowser. If the HTML tag contains a link to a manipulated page, a user can be tricked into accessing this page. Furthermore, an attacker can access information about running processes via the SNMP protocol. Sending such SNMP read commands can also trigger a reboot.

Mitigatiesamenvatting

Please install the updated firmware V1.3.13.

Risk evaluation

Weidmueller industrial ethernet switches are affected by multiple vulnerabilities. Weidmueller has released new firmwares of the affected products to fix the vulnerabilities.

Mitigatiesamenvatting

Update to version V3.6.32

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbNET.mini product allowing for RCE or unauthorized file access.

Mitigatiesamenvatting

Update mbNET.mini to the version 2.3.1

Risk evaluation

The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.

Mitigatiesamenvatting

Update to latest version: 2.16.2 CVE-2024-23943: This fix does not apply to mbNET/mbNET.rokey devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Risk evaluation

Multiple vulnerabilities have been discovered in REX100 allowing for RCE or unauthorized file access.

Mitigatiesamenvatting

Update REX100 to the version 2.3.1

Risk evaluation

The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP.

Mitigatiesamenvatting

- Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet. - Deactivate EtherNet/IP in device settings if not used

Risk evaluation

A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.

Mitigatiesamenvatting

Temporarily disable the WebGUI or restrict network access to the WebGUI to trusted admin stations.

Risk evaluation

On certain operating systems (e.g., Linux), default file system permissions may allow read access to the files of the CODESYS Control runtime system for non-administrator users. The documentation provided with the CODESYS Runtime Toolkit does not explicitly address this risk. As a result, products based on the toolkit may unintentionally expose sensitive runtime files to local operating system users with limited privileges. CODESYS Control runtime system based devices are affected if they provide access to the operating system (e.g., via a local user interface or SSH) and user accounts without administrator rights for this access exist or can be created.

Mitigatiesamenvatting

If the CODESYS Control runtime system is operated on an operating system with multi-user support, other users may potentially gain access to runtime-related files. Thus, it is essential to configure the storage locations for CODESYS Control runtime files in accordance with the operating system's security best practices. These locations should, by default, restrict access to unauthorized users. If the operating system does not support such access control mechanisms or if implementing them is not feasible, an alternative approach is to explicitly revoke read and write permissions for all non-administrative users on the directories used by the CODESYS Control runtime system. The following directories must be secured: * The directory containing configuration files * The directory containing binary files * The working directory used by the runtime system Note: Protecting individual files is not sufficient. The entire directories must be secured to ensure that any files created in the future are also protected. Alternatively, where applicable, all non-administrative user accounts can be removed from the system, and their re-creation should be prevented. Additionally, it is recommended to disable remote access methods that allow file access (e.g., SSH) wherever possible, in order to reduce the overall attack surface. Best practice recommendations for Linux and QNX Systems: * Create a dedicated privileged group for accessing the above-mentioned directories, and add the user account under which the runtime process is executed to this group. * Set the file system permissions for these directories to deny access to "other" users (e.g., chmod o-rx). * If access for additional users is required, they can be added to the privileged group as needed.

Risk evaluation

An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.

Mitigatiesamenvatting

Update mbNET/mbNET.rokey to at least version 7.3.0\ **Note**: mbNET HW1 is EOL and will not receive any further updates.

Risk evaluation

An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in REX200/250 devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.

Mitigatiesamenvatting

Update REX 200/250 to at least version 7.3.0\ **Note**: REX 300 is EOL and will not receive any further updates.

Risk evaluation

Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.

Mitigatiesamenvatting

Currently no fix is planned. Festo recommends limiting access to the webserver (tcp port 80) of the device to what is absolutely necessary. Replace CPX-CEC-C1 with follow-up product CPX-CEC-C1-V3. Replace CPX-CMXX with follow up product CPX-CEC-M1-V3.

Risk evaluation

Weidmueller security routers IE-SR-2TX are affected by multiple vulnerabilities (CVE-2025-41661, CVE-2025-41663, CVE-2025-41683, CVE-2025-41684, CVE-2025-41687). Weidmueller has released new firmware versions of the affected products to fix the vulnerabilities. **Update Version 1.1.0:** Added CVEs CVE-2025-41683, CVE-2025-41684 and CVE-2025-41687. Updated CVSS Score for CVE-2025-41663. Removed CVE-2025-41662.

Mitigatiesamenvatting

Update to version V1.49

Risk evaluation

Multiple vulnerabilities in all mbNET.mini devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.

Mitigatiesamenvatting

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk evaluation

Multiple vulnerabilities in all REX 100 devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.

Mitigatiesamenvatting

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk evaluation

The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.

Mitigatiesamenvatting

No fix planned. This issue will be handled with next hardware generation release.

Risk evaluation

During installation, identical certificates are installed across all systems instead of unique ones, which are intended for JWT Token encryption and signing.

Mitigatiesamenvatting

Update to WAGO Device Sphere version 1.0.1. WAGO Device Sphere version 1.0 can't be used after the 30.06.2025.

Risk evaluation

Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating system with privileged rights.

Mitigatiesamenvatting

Consult our PDF with remediations which you can find under [www.pilz.com/downloads](https://www.pilz.com/search#currentPage=1&SEARCH=Security%20Advis.%20IndustrialPI%20Remediat.). In order to activate the authentication as described in the PDF, you have to have the Node-RED service enabled via the web application.

Risk evaluation

The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.

Mitigatiesamenvatting

Update the webstatus package to version 2.4.6 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the webstatus package, use 'dpkg -l | grep revpi-webstatus'.

Risk evaluation

PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The third vulnerability with medium severity puts PiCtory at a risk of a reflected cross-site-scripting attack.

Mitigatiesamenvatting

Update the PiCtory package to version 2.12 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the pictory package, use 'dpkg -l | grep pictory'.

Risk evaluation

A security vulnerability was discovered in the PLC Designer V4 in the version 4.0.0 where the programmer of a Controller can set a password for the connected device. Here it is possible in an interface of the PLC Designer V4 for the programmer to enter a password for the Device. There is a special constellation where the password entered appears in plain text. Only the display in the tool is affected and not the management of the password on the device. This vulnerability of PLC Designer V4 only occurs in combination with the devices c430 controller, c520 controller and c550 controller and not in combination with other devices, as this functionality is only used here. It is generally recommended that all users update to 4.0.1, but especially all users who operate PLC Designer V4 in combination with the controllers mentioned.

Mitigatiesamenvatting

This vulnerability has been fixed in the new version. All users are strongly recommended to use the new version 4.0.1.