ICS Advisories

Risk evaluation

A local attacker who successfully exploited this vulnerability could gain elevated privileges by Path Traversal, arbitrarily reading files of system, to cause confidentiality impact of system files.

Mitigatiesamenvatting

Mint Workbench I 5876 and the versions before, are impacted, customers who use these products, should: - Disable Service MWI http when it is not in active use. - Restrict physical machine access to authorized personnel only. - Avoid storing sensitive or confidential data on any hosts running service MWI http. - Enable User Account Control (UAC) to block unauthorized privilege escalation attempts. These actions above are the only measures available. No further patch will be released because this product reaches end-of-life globally (out of China) by the end of 2026 and in China by the end of 2027. To exploit the vulnerability the attacker needs to have local access to the machine beforehand and have file write access in the path. Please also refer to section “General security recommendations” for further advise on how to keep your system secure.

Risk evaluation

ABB is aware of vulnerabilities in the products versions listed as affected in the advisory. Automation Builder could execute arbitrary code by crafting the project file or project archive file.

Mitigatiesamenvatting

The problem is corrected in the following product version: - Automation Builder 2.9.1 ABB recommends that customers apply the update at earliest convenience. Automation Builder 2.9.1 is available for download from the related download site.

Risk evaluation

An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).

Mitigatiesamenvatting

The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download

Risk evaluation

ABB is aware of a privately reported vulnerability affecting the PCM600 project import functionality. An update is available that resolves this vulnerability in the affected product versions. A specially crafted PCM600 project archive may exploit insufficient validation of archive entry paths during project import. Successful exploitation could allow an attacker to create or overwrite files outside the intended extraction directory using the permissions of the importing user.

Mitigatiesamenvatting

The problem is corrected in the following product version: - ABB Protection and Control IED Manager (PCM600) version 2.14 Hotfix 20260923. This fixed version is available through the ABB Update Manager and ABB website: PCM600 | ABB ABB recommends that customers upgrade to the available hotfix at the earliest opportunity. Until the update can be applied, customers should follow the mitigation measures described in this advisory.

Risk evaluation

ABB is aware of a reported vulnerability in ABB Protection and Control IED Manager (PCM600). A local authenticated user belonging to the PCM600 user group may be able to modify the configuration of a Windows service running with SYSTEM privileges. Successful exploitation could allow an attacker to execute arbitrary commands with elevated privileges on the affected workstation. Note: This document references the ABBPCMSchedulerService_v214 component as implemented in PCM600 version 2.14. However, the described issue is not version-specific and applies equally to the corresponding component in other supported versions of PCM600.

Mitigatiesamenvatting

ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation. Configure the appropriate ABBPCMSchedulerService instance to run using the same Windows account that is used to operate PCM600. - Open Services.msc. - Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version. - Open Properties and select the Log On tab. - The service should be configured to log on with the same Windows user account that is used for the PCM600 application. - Ensure that this account has the required "Log on as a service" privilege. When authentication is enabled for the IED, the Scheduler tool must be used with the same Windows account configured as the Scheduler Service logon account. For installations using IED security certificates, the PCM600 setting Always trust IED security certificates must be enabled only when PCM600-to-IED communication takes place in a secure and trusted environment. Impact of Workaround -Scheduler functionality will operate using the privileges of the configured Windows user account rather than SYSTEM privileges. - Users may need to be granted the "Log on as a service" Windows user right. - In environments using IED security certificates, enabling Always trust IED security certificates may reduce certificate validation protections and should only be used in secure and trusted environments. - Administrative effort may be required to maintain consistent user accounts between PCM600 and the Scheduler Service.

Risk evaluation

This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.

Mitigatiesamenvatting

Zie de officiële CISA-advisory voor mitigerende maatregelen.

Risk evaluation

The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.

Mitigatiesamenvatting

The Lenze VPN Client is available and downloadable via the Fleet Manager. Please update this Client. Obtain the update software (version >= 1.4.7) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: ``` tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install ```

Risk evaluation

ABB is aware of a vulnerability in the product versions listed as affected in the advisory. An update is available that resolves the reported vulnerability in the product versions under maintenance. An attacker who successfully exploited this vulnerability could cause the product to stop or make the product inaccessible.

Mitigatiesamenvatting

Refer to section “General security recommendations” for further advice on how to keep your system secure, as well checking the section “Workarounds”.

Risk evaluation

ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above. An attacker who successfully exploited this vulnerability could take remote control of the product. The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the 'Forgot Password' functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts. Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.

Mitigatiesamenvatting

The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected. - Email Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Risk evaluation

The firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices is affected by security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.

Mitigatiesamenvatting

Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.

Risk evaluation

The affected devices have security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.

Mitigatiesamenvatting

Install update 1.7.8.

Risk evaluation

The TRUMPF product versions listed below include a Wibu CodeMeter Runtime version that contains several vulnerabilities, e.g. potentially allowing privilege escalation.

Mitigatiesamenvatting

An updated Wibu Codemeter Runtime is available for download. If your installation is affected, the easiest fix is to install the latest Runtime from https://www.wibu.com/support/user/user-software.html

Risk evaluation

SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate forwarded request headers. Successful exploitation may impact the integrity and availability of affected systems. SICK has addressed these vulnerabilities and recommends that customers apply the remediations described in this Security Advisory.

Mitigatiesamenvatting

Users are recommended to upgrade to version 2026.1.1.

Risk evaluation

The Device Manager extension shipped with Sentio Creator is affected by CVE-2026-80469. Affected versions are pre-installed in Sentio Creator releases up to and including version 2026.2. As the Device Manager extension can be updated independently of Sentio Creator, SICK recommends applying the defined remediations for this vulnerability.

Mitigatiesamenvatting

Users are strongly recommended to upgrade the Device Manager extension for Sentio Creator to version 1.4.1.

Risk evaluation

An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could - Allow arbitrary files to be deleted with system privileges (CVE-2026-81572), - Read potentially sensitive configuration data and overwrite selected values in Server.ini (CVE-2026-81573) - Crash CodeMeter and disclose sensitive information such as process memory and stack canar-ies (CVE-2026-81574) - Crash CodeMeter (CVE-2026-81575), or - Read potentially sensitive license information (CVE-2026-81576)

Mitigatiesamenvatting

For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

Risk evaluation

ABB is aware of publicly disclosed security vulnerabilities affecting the WIBU-Systems CodeMeter Runtime for Windows, identified as CVE-2026-81572, CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576. The CodeMeter Runtime component is used within affected ABB zenon Software Platform installations for software licensing and license server functionality. Successful exploitation of the reported vulnerabilities could enable local privilege escalation on Windows systems and impact systems configured as CodeMeter license servers, potentially leading to unauthorized access, service disruption, or loss of system integrity. Refer to the WIBU-Systems advisory for detailed technical information on each vulnerability. Please see the References section for the WIBU-Systems security advisory.

Mitigatiesamenvatting

ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products. The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex networked communication, display and control applications Failure to apply the mitigations or remediations provided below may risk execution of unsolicited command on the PLC which could result in a loss of availability of the controller.

Mitigatiesamenvatting

Version sv4.20 of Modicon M580 includes a fix for this vulnerability and is available for download here: STEP 1: Update software and firmware. • On the engineering workstation, update to EcoStruxure Control Expert v16.0: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware • On the Modicon M580 controller, update to firmware SV4.20 or above: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware STEP 2: Update projects in EcoStruxure™ Control Expert by: • Setting up an application password in the project properties • Changing the version of the controller firmware to match the new firmware version of the target controller STEP 3: Rebuild and transfer projects in EcoStruxure™ Control Expert: • Rebuild all current projects

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, Modicon M340, Momentum, MC80, M580 and M580 CPU Safety. The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability & safety solutions. The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. The Modicon MC80 provides optimized operation, withstanding extreme conditions with high reliability and performance. The Modicon Momentum supports control and distributed I/O system with 4 fundamental components that easily snap together in various combinations to form versatile control systems or sub-systems. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers). Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality and integrity of the controller.

Mitigatiesamenvatting

Firmware SV4.20 includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert and Modicon M340, M580 PLCs (Programmable Logic Controllers). Modicon PLCs control and monitor industrial operations. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs. EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate, and maintain an entire plant Infrastructure. Failure to apply the remediations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Mitigatiesamenvatting

SV3.60 of Modicon M340 firmware includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468- modicon-m340

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 / EcoStruxure™ Control Expert products. [Modicon PAC](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=business-1-industrial-automation-and-control) products control and monitor industrial operations. [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#overview) is the engineering application for Modicon Controllers. Failure to apply the provided remediations/mitigations below may risk unauthorized access to the controller, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.

Mitigatiesamenvatting

Firmware SV2.90 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/535-modicon-momentum/#software-and-firmware Important: Customer needs to use version of EcoStruxure™ Control Expert v16.2 HF003 minimum to connect with the latest version of Modicon Momentum.

Risk evaluation

Schneider Electric is aware of its vulnerability in its EcoStruxure IT Data Center Expert product The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes,and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure and remote compromise of the offer which could result in disruption of operations and access to system data.

Mitigatiesamenvatting

Version 9.2 of EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61851#software-and-firmware Reboot needed: Upon installation, the service is automatically restarted. Users can validate a successful installation by logging in to the web client. The installed version is displayed in the bottom-left corner of the main screen.

Risk evaluation

Schneider Electric is aware of a vulnerability in the Head Unit (HU250) for the PowerLogic T300 RTU (Remote Terminal Unit) (formerly Easergy T300 RTU). The [PowerLogic T300 RTU](https://www.se.com/ww/en/product-range/62399-easergy-t300) is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the remediation provided below may risk privilege escalation, which could result in unauthorized takeover of the device.

Mitigatiesamenvatting

Version 2.9.8-5621 of PowerLogic T300 includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to obtain the fixed firmware. • Reboot required

Risk evaluation

Schneider Electric is aware of a vulnerability in its Modicon M580 and Modicon M580 Safety controllers. The Modicon M580 is an Ethernet-based Programmable Automation Controller (ePAC) designed for industrial digital transformation. Failure to apply the remediations provided below may risk establishing an unauthenticated connection to Modicon M580 or M580 Safety controllers which could result in loss of confidentiality, integrity and availability of the PLC.

Mitigatiesamenvatting

Ensure to use firmware version 4.10 or above AND Update your application project to application level 4.00 or above. Application level 4.00 is available in EcoStruxure Control Expert V15.2 or later versions.

Risk evaluation

Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potentially resulting in a loss of confidentiality.

Mitigatiesamenvatting

Implement the Role-Based Access Control (RBAC) feature and follow the SCADAPack documentation sections Security Guidelines for Administrators and Working with Role-Based Access Control. RBAC is the recommended access control mechanism for SCADAPack 47x devices and should be used in place of the Secure Lock feature. The Secure Lock feature is legacy functionality retained for backward compatibility with existing deployments and should only be used where required to support legacy system requirements. Consult the SCADAPack Cybersecurity Guide, including the SCADAPack Hardening and Secured Communication sections. In addition, apply the following standard practices to reduce the risk of exploitation: • Configure network segmentation to restrict access between trusted and untrusted networks. • Enable and implement the RTU firewall service to restrict unauthorized access to device services and reduce the attack surface. Documentation available in [RemoteConnect and SCADAPack x70 Utilities | Schneider Electric](https://www.se.com/ww/en/download/document/RemoteConnect/)

Risk evaluation

An update is available that resolves publicly reported vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could - allow arbitrary files to be deleted with system privileges (CVE-2026-81572), - read potentially sensitive configuration data and overwrite selected values in Server.ini (CVE-2026-81573), - crash CodeMeter and disclose sensitive information such as process memory and stack canaries (CVE-2026-81574), - crash CodeMeter (CVE-2026-81575), or - read potentially sensitive license information (CVE-2026-81576)

Mitigatiesamenvatting

For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.