ICS Advisories

Risk evaluation

The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device.

Mitigatiesamenvatting

To resolve this security vulnerability, we recommend installing a firmware update. | Product | Firmware | Fixed Version | | --------------- | -------- | ------------- | | Controller c430 | c4xx | 1.15.2 | | c520 | c5xx | 1.15.2 | | c550 | c5xx | 1.15.2 | | i950 GenA | i950 | 1.15.0 | | i950 GenB | i950 | 2.0.3 |

Risk evaluation

Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.

Mitigatiesamenvatting

MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.

Risk evaluation

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

Mitigatiesamenvatting

MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.

Risk evaluation

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.

Mitigatiesamenvatting

Users using the affected software, should upgrade to one of the corrected versions as follows:

Risk evaluation

Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.

Mitigatiesamenvatting

Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Risk evaluation

Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.

Mitigatiesamenvatting

Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.

Risk evaluation

Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.

Mitigatiesamenvatting

Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.

Risk evaluation

Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.

Mitigatiesamenvatting

Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)

Risk evaluation

Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.

Mitigatiesamenvatting

Rockwell Automation recommends users to upgrade to 1718/ 1719 Ex I/O version 3.012 or later.

Risk evaluation

Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.

Mitigatiesamenvatting

Users using FactoryTalk Services Platform v6.60 should apply either the individual patch (RAID 1158263) or the February 2026 Patch Roll-up, or later update.

Risk evaluation

CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Mitigatiesamenvatting

Update to V2511 or later version

Risk evaluation

Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Mitigatiesamenvatting

Update to V10.6.1 or later version

Risk evaluation

SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.

Mitigatiesamenvatting

Update to V7.26.0310 or later version

Risk evaluation

Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version.

Mitigatiesamenvatting

Update to V2604 or later version

Risk evaluation

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/

Mitigatiesamenvatting

Contact customer support to receive patch and update information

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24.

Mitigatiesamenvatting

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.20.1.

Risk evaluation

Helmholz: Multiple SQLi vulnerabilities in myREX24V2/myREX24V2.virtual

Mitigatiesamenvatting

Update the myREX24V2/myREX24V2.virtual instance to version 2.20.1.

Risk evaluation

ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. An attacker who successfully exploited this vulnerability could cause the product to become unusable. ABB confirms the vulnerability but at the same time acknowledges that the issue affects exclusively classic KNX devices that are not supporting the latest KNX Secure standard. Due to a lack of security in legacy KNX devices, the issue cannot be resolved via a software change. In order to actively exploit this vulnerability, an attacker requires physical access to the bus, the affected device is connected to. ABB has no plans of corrective measures.

Mitigatiesamenvatting

Due to the nature of the classic KNX protocol stack and security concept, there are no options to resolve the vulnerability with a software update on a technical level. ABB recommends to follow general security recommendations listed in the security guideline (see References and General security recommendations). In addition, it shall be avoided to control sensitive functionality by legacy KNX devices such as, but not limited to, access control to e.g. hotel rooms or other protected areas. Note: Legacy KNX standards were never designed to meet state of the art security standards like introduced with KNX Data Secure published in 2017.

Risk evaluation

A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.

Mitigatiesamenvatting

Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.

Risk evaluation

A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.

Mitigatiesamenvatting

Restrict device access to trusted and authorized entities only. Apply the general security measures during product operation to mitigate the identified security risk. Refer to the ICS‑CERT Recommended Practices for Industrial Security for additional guidance.

Risk evaluation

Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.

Mitigatiesamenvatting

Rockwell Automation recommends users to upgrade to the following: DataMosaix Private Cloud versions 8.03 or later.

Risk evaluation

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.

Mitigatiesamenvatting

Rockwell Automation recommends users to upgrade to the following: Flex 5000 Adapter version 6.012.

Risk evaluation

Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated operator credentials and the partition feature to be enabled; installations without partitioning are not affected.

Mitigatiesamenvatting

Users of SALTO ProAccess using the tenancy feature should upgrade to version 6.13.

Risk evaluation

Multiple Murrelektronik network-enabled devices respond to SNMPv2c 'GETBULK' requests with disproportionately large response packets when the requesting party specifies a large max-repetitions value. This response amplification allows the affected devices to be misused as reflectors in distributed denial-of-service (DDoS) attacks against arbitrary third-party victims on the internet.

Mitigatiesamenvatting

A firmware update that addresses the SNMP GETBULK response amplification behaviour is planned for release in early 2027 for the Murrelektronik MVK Pro and Impact67 Pro product lines. Until the fix becomes available, customers should apply the mitigations described above.

Risk evaluation

Several Murrelektronik devices using Profinet are shipped with the default SNMP community names ('public' for read access and 'private' for write access). If these community strings remain unchanged in the field, an unauthenticated attacker with network access to the device can read its configuration and, depending on the writable OIDs, modify device settings.

Mitigatiesamenvatting

A firmware update addressing the vulnerability is planned for early 2027 for the Impact67 Pro (article numbers 54620, 54630) and MVK Pro (article numbers 54600, 54610) product variants.