Review – Public ICS Disclosures – Week of 11-29-25 – Part 1

This is a moderately busy disclosure week. We bulk disclosures from HPE (9). We also have nine additional vendor disclosures from CODESYS (3), Hitachi Energy, HP, Medtronic, Meinberg, and Philips (2).

Bulk Disclosures – HPE

• HPESBHF04944 rev.1 - HPE Superdome Flex 280 and Compute Scale-up Server 3200 Platform Servers Using Certain Intel Processors, INTEL-SA-01280, 2025.3 IPU, Intel Chipset Firmware Advisory, Multiple Vulnerabilities,

• HPESBNW04974 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities,

• HPESBNW04976 rev.1 - HPE Virtualized Telecommunication Management Information Platform (vTeMIP), Multiple Vulnerabilities,

• HPESBNW04972 Rev. 1 - HPE Telco Network Function Virtual Orchestrator, Multiple Vulnerabilities,

• HPESBUX04977 rev.1 - HP-UX Using OpenSSL, Memory Corruption and Remote Code Execution Vulnerabilities,

• HPESBCR04979 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01280, 2025.3 IPU, Intel Chipset Firmware Advisory, Multiple Vulnerabilities,

• HPESBCR04980 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01312, Intel TDX Module Advisory, Multiple Vulnerabilities,

• HPESBCR04981 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01313, 2025.3 IPU, Intel Xeon Processor Firmware Advisory, Multiple Vulnerabilities,

• HPESBCR04982 rev.1 - HPE Cray XD670 Server Using UEFI, Multiple Vulnerabilities.

Advisories

CODESYS Advisory #1 - CODESYS published an advisory that describes an out-of-bounds read vulnerability in their Control runtime system.

CODESYS Advisory #2 - CODESYS published an advisory that describes a type confusion vulnerability in their Control runtime system's CmpVisuServer component.

CODESYS Advisory #3 - CODESYS published an advisory that describes a deserialization of untrusted data vulnerability in their Development System.

Hitachi Energy Advisory - Hitachi Energy published an advisory that discusses a deserialization of untrusted data vulnerability (listed in CISA’s Known Exploited Vulnerability catalog) in their React Server Components.

HP Advisory - HP published an advisory that describes a race condition enabling link following vulnerability in their Image Assistant product.

Medtronic Advisory - Medtronic published an advisory that describes four vulnerabilities in their CareLink Network web application.

Meinberg Advisory - Meinberg published an advisory that discusses three vulnerabilities (one with publicly available exploit) in their LANTIME product.

Philips Advisory #1 - Philips published an advisory that discusses the Meta React Server Components vulnerability that was added to CISA’s KEV catalog.

Philips Advisory #2 - Philips published an advisory that discusses the Vercel NEXT.js vulnerability that is associated with the Meta React Server vulnerability.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-08a - subscription required.