Review – 7 Advisories and 2 Updates Published – 9-18-25

Today CISA’s NCCIC-ICS published control system security advisories for products from Dover Fueling, Cognex, Hitachi Energy (2), Schneider Electric, and Westermo (2). They also published an update for products from Mitsubishi and End-of-Train.

Advisories

Dover Advisory - This advisory describes three vulnerabilities in the Dover ProGauge MagLink LX4 products.

Cognex Advisory - This advisory describes nine vulnerabilities in the Cognex In-Sight Explorer and In-Sight Camera products.

Hitachi Energy Advisory #1 - This advisory discusses a deserialization of untrusted data vulnerability (with publicly available exploit) in the Hitachi Energy Service Suite.

NOTE: I briefly discussed this vulnerability on August 30^th, 2025.

Hitachi Energy Advisory #2 - This advisory discusses six vulnerabilities (two with publicly available exploits) in the Hitachi Energy Asset Suite product.

NOTE: I briefly discussed this vulnerability on August 30^th, 2025.

Schneider Advisory - This advisory describes two OS command injection vulnerabilities in the Schneider Saitel DR & Saitel DP remote terminal units.

Westermo Advisory #1 - This advisory describes an improper validation of syntactic correctness of input vulnerability in the Westermo WeOS 5 products.

NOTE: I briefly discussed this vulnerability on March 29^th, 2025.

Westermo Advisory #2 - This advisory describes an OS command injection vulnerability in the Westermo WeOS 5 product.

NOTE: I briefly discussed this vulnerability on July 6^th, 2025.

Updates

Mitsubishi Update - This update provides additional information on the FA Engineering Software advisory that was originally published on January 30^th, 2024, and most recently updated on February 13^th, 2025.

End-of-Train Update - This update provides additional information on the Remote Linking Protocol advisory that was originally published on July 10^th, 2025, and most recently updated on September 4^th, 2025.

 

For more information on these advisories, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-2-updates-published-13d - subscription required.

Review – 6 Advisories and 2 Updates Published – 9-24-24

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Moxa, OMNTEC, Dover Fueling Solutions, Franklin Fueling Solutions, Alisonic, and OPW Fuel Management Solutions. They also updated advisories for products from Interpeak and Uniview.

Advisories

Moxa Advisory - This advisory describes three vulnerabilities in the Moxa MXview One products.

OMNTEC Advisory - This advisory describes a missing authentication for critical function vulnerability in the OMNTEC Proteus Tank Monitoring product.

Dover Advisory - This advisory describes six vulnerabilities in the DFS ProGauge MAGLINK LX Consoles.

Franklin Advisory - This advisory describes an absolute path traversal vulnerability in the Franklin TS-550 EVO automatic tank gauge.

Alisonic Advisory - This advisory describes an SQL injection vulnerability in the Alisonic Sibylla automated tank gauge.

OPW Advisory - This advisory describes a missing authentication for critical function vulnerability in the OPW SiteSentinel product.

NOTE: The vulnerabilities for the five fuel handling equipment advisories were reported to CISA by Pedro Umbelino of BitSight; that report is worth reading.

Updates

Interpeak Update - This update provides additional information on the Interpeak TCP/IP Stack advisory that was originally published on October 1^st, 2019 and most recently updated on May 12^th, 2020.

Uniview Update - This update provides additional information on the Uniview NVR301-04S2-P4 advisory that was originally published on June 4^th, 2024.

 

For more information on these advisories, including links to a researcher report and a down-the-rabbit-hole look at relay rapid cycling attacks, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-2-updates-published - subscription required.