Review – 7 Advisories and 2 Updates Published – 12-4-25

Today CISA’s NCCIC-ICS published seven control system security advisories for products from Advantech, Solis Cloud, Sunbird, Johnson Controls (2), MAXHIB, and Mitsubishi. They also updated advisories for products from Johnson Controls and Consilium.

Advisories

Advantech Advisory - This advisory describes an SQL injection vulnerability in the Advantech iView product.

SolisCloud Advisory - This advisory describes an authorization bypass through a user controlled key vulnerability in the SolisCloud Monitoring Platform.

Sunbird Advisory - This advisory describes two vulnerabilities in the Sunbird DCIM dcTrack and Power IQ products.

Johnson Controls Advisory #1 - This advisory describes an improper validation of certificate expiration vulnerability in the Johnson Controls iStar products.

Johnson Controls Advisory #2 - This advisory describes a forced browsing vulnerability in the Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace.

MAXHUB Advisory - This advisory describes a weak password recovery mechanism for forgotten password vulnerability in the MAXHUB Pivot client.

Mitsubishi Advisory - This advisory describes a cleartext storage of sensitive information vulnerability in the Mitsubishi GX Works2 product.

NOTE: I briefly discussed this vulnerability on November 29^th, 2025.

Updates

Johnson Control Update - This update provides additional information on the FX80 and FX90 advisory that was originally published on August 7^th, 2025.

Consilium Update - This update provides additional information on the CS5000 Fire Panel advisory that was originally published on May 29^th, 2025.

NOTE: The original CISA advisory noted that no fix was planned for these vulnerabilities. See my May 29^th, 2025, post for more information.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-2-updates-published-67d - subscription required.

Review – 5 Advisories and 2 Updates Published

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Johnson Controls (3), Mitsubishi Electric, and Delta Electronics. They also updated advisories for products from Mitsubishi and PTC.

Advisories

Johnson Controls Advisory #1 - This advisory describes an incorrect default permissions vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #2 - This advisory describes a use of weak credentials vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #3 - This advisory discusses a dependency on vulnerable 3rd party component (JQuery) in the Johnson Controls Illustra Pro Gen 4 Camera.

Mitsubishi Advisory - This advisory describes an incorrect default permissions vulnerability in the Mitsubishi MELIPC Series MI5122-VW industrial PC.

Delta Advisory - This advisory describes four vulnerabilities in the Delta CNCSoft-G2.

Updates

Mitsubishi Update - This update provides additional information for the FA Engineering Software advisory that was originally published on September 26^th, 2023.

PTC Update - This update provides additional information for the PTC Creo Elements advisory that was originally published on June 25^th, 2024.

 

For more information on these advisories, including a down-the-rabbit-hole look at how CWE-1395 can hide the real extent of the 3^rd party vulnerabilities in a system, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-2-updates-published-a8a - subscription required.

Review – 11 Advisories and 1 Update Published – 8-30-22

Today, CISA’s NCCIC-ICS published eleven control system security advisories for products from Johnson Control, PTC Kepware, Omron, Honeywell (3), Fuji Electric, and Hitachi Energy (4). They also updated an advisory for products from Mitsubishi Electric.

Johnson Control Advisory - This advisory describes a command injection vulnerability in the Johnson Control (Tyco subsidiary) iSTAR Ultra door controller.

PTC Advisory - This advisory describes two vulnerabilities on the Kepware KEPServerEX connectivity platform.

NOTE: NCCIC-ICS reports that these vulnerabilities also affect the following products as thirdparty vulnerabilities:

• Rockwell Automation KEPServer Enterprise,

• GE Digital Industrial Gateway Server, and

• Software Toolbox TOP Server

Honeywell Advisory #1 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Trend Controls IQ Series IC.

Honeywell Advisory #2 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Experion LX distributed control system.

Honeywell Advisory #3 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell ControlEdge PLC.

Fuji Advisory - This advisory describes two vulnerabilities in the Fuji D300win programming support tool.

Hitachi Energy Advisory #1 - This advisory describes an improper input validation vulnerability in the Hitachi Energy RTU500.

Hitachi Energy Advisory #2 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy MSM Product.

NOTE: I briefly discussed the 13 underlying vulnerabilities (3 with known exploits) on July 16^th, 2022.

Hitachi Energy Advisory #3 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy Gateway Station product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Hitachi Energy Advisory #4 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy FACTS Control Platform product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Mitsubishi Update - This update provides additional information for an advisory that was originally published on August 9th, 2022 and most recently updated on August 18^th, 2022.

 

For more details on these advisories and the update, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published - subscription required.