Review - Public ICS Disclosures – Week of 5-25-25 – Part 2

For Part 2 this week we have six additional vendor disclosures from Lenze, Mitsubishi, PEPPERL+Fuchs, QNAP, WatchGuard, and Weidmueller. There are also nine updates from FortiGuard, Hitachi Energy (6), HP, and HPE. Finally, we have two exploits for products from Palo Alto Networks and SCADAFlare.

Advisories

Lenze Advisory - CERT-VDE published an advisory that discusses two vulnerabilities in the Lenze x500 IoT Gateway.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an improper validation of specified index, position or offset in input vulnerability in their MELSEC iQ-F Series CPU module.

PEPPERL+Fuchs Advisory - CERT-VDE published an advisory that describes three vulnerabilities in the PEPPERL+Fuchs  Profinet Gateway LB8122A.1.EL.

QNAP Advisory - QNAP published an advisory that discusses an untrusted search path vulnerability in the GNU C Library.

WatchGuard Advisory - WatchGuard published an advisory that describes a privilege escalation vulnerability in their Mobile VPN product.

Weidmueller Advisory - CERT-VDE published an advisory that describes five vulnerabilities in multiple Weidmueller industrial ethernet switches.

Updates

FortiGuard Update - FortiGuard published an update for their TACACS+ authentication bypass advisory that was originally published on May 13^th, 2025.

Hitachi Energy Update #1 - Hitachi Energy published an update for their IEC 61850 MMS-Server advisory that was originally published on February 14^th, 2024.

Hitachi Energy Update #2 - Hitachi Energy published an update for their BadAlloc advisory that was originally published on December 16^th, 2021.

Hitachi Energy Update #3 - Hitachi Energy published an update for their OpenSSL Vulnerability advisory that was originally published on June 27^th, 2023.

Hitachi Energy Update #4 - Hitachi Energy published an update for their Relion 670/650/SAM600-IO advisory that was originally published on November 28^th, 2023, and most recently updated on September 23^rd, 2024.

Hitachi Energy Update #7 - Hitachi Energy published an update for their Hitachi Energy Relion 670/650/SAM600-IO advisory that was originally published on November 4^th, 2021, and most recently updated on December 7^th, 2021.

Hitachi Energy Update #6 - Hitachi Energy published an update for their Hitachi Energy’s Relion 670, 650 and SAM600-IO advisory that was originally published on February 28^th, 2023.

HP Update - HP published an update for their Sound Research SECOMN64 advisory that was originally published on November 12^th, 2024.

HPE Update - HPE published an update for their HPE ProLiant AMD Servers advisory that was originally published on February 3^rd, 2025.

Exploits

Palo Alto Networks Exploit - Cody 16 published an exploit for a memory corruption vulnerability in the Palo Alto Networks CLI.

SCADAFlare Exploit - Fellipe Oliveira published an exploit for an unrestricted upload of file with dangerous type vulnerability in the SCADAFlare ScadaBR product.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-d6e - subscription required.