Review – 19 Advisories and 1 Update Published – 10-22-26

Today CISA’s NCCIC-ICS published 18 control system security advisories for products from Siemens (17) and Kiloview. They also published a medical device security advisory for products from Kiloview. Finally, they updated an advisory for products from Meari IoT. 

Advisories  

RUGGEDCOM Advisory #1 - This advisory discusses four vulnerabilities in the Siemens RUGGEDCOM APE1808. These are third-party (Nozomi Networks) vulnerabilities. 

RUGGEDCOM Advisory #2 - This advisory describes six vulnerabilities in the Siemens RUGGEDCOM CROSSBOW Station Access Controller. These are third-party (SQLite) vulnerabilities; four with publicly available exploits. 

RUGGEDCOM Advisory #3 - This advisory describes 11 vulnerabilities in the Siemens RUGGEDCOM CROSSBOW. The vulnerabilities were self-reported. 

Industrial Edge Advisory #1 - This advisory describes two vulnerabilities in the Siemens Industrial Edge Cloud Device (IECD). The vulnerabilities were self-reported. 

Industrial Edge Advisory #2 - This advisory describes two vulnerabilities in the Siemens Industrial Edge Device Kit. The vulnerabilities were self-reported. 

Industrial Edge Advisory #3 - This advisory describes two vulnerabilities in the Siemens Industrial Edge App Publisher. According to the Siemens advisory, the vulnerabilities were reported by Ezinne Kalu. 

SIMATIC S7 Advisory #1 - This advisory discusses 377 vulnerabilities in the Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. These are third-party (Linux) vulnerabilities. 

SIMATIC S7 Advisory #2 - This advisory describes eight vulnerabilities in the Siemens SIMATIC Drive Controller CPU 1504D TF. The vulnerabilities were self-reported. 

SIMATIC S7 Advisory #3 - This advisory discusses 428 vulnerabilities in the Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. These are third-party (Linux) vulnerabilities. 

SIMATIC S7 Advisory #4 - This advisory describes two vulnerabilities in the Siemens .NET Client Library for SIMATIC S7 Webserver API. The vulnerabilities were self-reported. 

WinCC Advisory - This advisory describes an incorrect privilege assignment vulnerability in the Siemens SIMATIC WinCC V7.5. According to the Siemens advisory, the vulnerability was reported by Sascha Meyer, Simon Wessling, and Jonathan Lauener from GAI NetConsult GmbH. 

APOGEE Advisory - This advisory describes five vulnerabilities in the Siemens APOGEE, TALON and Desigo PXC/PXM products. According to the Siemens advisory, the vulnerabilities were reported by Stanislav Dashevskyi and Francesco La Spina from Forescout Technologies. 

SIMATIC IPCs Advisory - This advisory describes a use of default cryptographic key vulnerability in the Siemens SIMATIC IPC BX-21A. The vulnerability was self-reported. 

PSS(R)SINCAL Advisory - This advisory discusses an out-of-bounds write vulnerability in the Siemens PSS(R)SINCAL V21.5. This is a third-party (Wibu) vulnerability.  

SENTRON Advisory - This advisory discusses an improper verification of source of a communications channel vulnerability in the Siemens SENTRON 3NA COM Fuse. The vulnerability was self-reported. 

Capital Advisory - This advisory describes an out-of-bounds read vulnerability in the Siemens Capital Embedded AR Classic 431-422. According to the Siemens advisory, the vulnerabilities were reported by Stanislav Dashevskyi and Francesco La Spina from Forescout Technologies. 

Software Center Advisory - This advisory describes an uncontrolled search path element vulnerability in the Siemens Siemens Software Center. According to the Siemens Advisory, the vulnerability was reported by Jose Oregon from Huntress Labs. 

Kiloview Advisory - This advisory describes nine vulnerabilities in the Kiloview E3 NDI Encoder. The vulnerabilities were reported to CISA by Juan Alonso. 

InterSystems Advisory - This advisory describes a cleartext transmission of sensitive information vulnerability in the InterSystems Corporation InterSystems IRIS for Health data platform. The vulnerability was reported to CISA by Abhinav Agarwal. 

Meari Update - This update provides additional information on the Cloud Platform advisory that was originally reported on October 1st, 2026. The new information includes adding vendor remediations for both CVEs. The original advisory reported that “Meari did not respond to CISA’s coordination attempts.” 

For more information on these advisories, as well as DTRH looks at publicly available exploits, additional reporting, and KEV vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/19-advisories-and-1-update-published-e1f - subscription required.