Review – Public ICS Disclosures – Week of 8-23-25 – Part 1

This week is a moderately busy disclosure week. We have bulk vendor disclosures from QNAP (11). We have 8 additional vendor disclosures from Cisco, Delta Electronics, Hitachi, Hitachi Energy (2), HPE (2), and Moxa.

Bulk Vendor Disclosures

QNAP (11)

Advisories

Cisco Advisory - Cisco published an advisory that describes an open redirect vulnerability in their Virtual Keyboard Video Monitor.

Delta Advisory - Delta published an advisory that describes an improper restriction of XML external entity reference vulnerability in their EIP Builder.

Hitachi Advisory – Hitachi published an advisory that discusses five vulnerabilities in multiple Hitachi products.

Hitachi Energy Advisory #1 - Hitachi published an advisory that discusses a JAVA deserialization vulnerability (with publicly available exploit and is listed in CISA’s KEV catalog) in their Service Suite Product.

Hitachi Energy Advisory #2 - Hitachi published an advisory that discusses six vulnerabilities (two with publicly available exploits) in their Asset Suite product.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities (one with publicly available exploit) in their HP-UX PAM RADIUS product.

HPE Advisory #2 - HPE published an advisory that discusses three vulnerabilities in their Compute Scale-up Server 3200 Platform Servers.

Moxa Advisory - Moxa published an advisory that describes an unquoted search path vulnerability in the Moxa Industrial Computers.

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-57d - subscription required.