Review – 7 Advisories and 3 Updates Published – 9-30-25

Today CISA’s NCCIC-ICS published seven control system security advisories for products from LG Innotek, National Instruments, OpenPLC, Festo (3) and MegaSys Enterprises. The also published updates for advisories for products from Rockwell Automation, HEIDENHHAIN, and Keysight.

Advisories

LG Advisory - This advisory describes an authentication bypass by alternate path or channel vulnerability in the LG Innotek LND7210 and LNV7210R cameras.

National Instruments Advisory - This advisory describes two vulnerabilities in the NI Circuit Design Suite.

OpenPLC Advisory - This advisory describe a reliance on undefined, unspecified, or implementation defined behavior vulnerability in the OpenPLC_V3 product.

Festo Advisory #1 - This advisory discusses 29 vulnerabilities in the Festo Controller CECC-S,-LK,-D Family Firmware.

Festo Advisory #2 - This advisory describes an improper privilege management vulnerability in the Festo CPX-CEC-C1 and CPX-CMXX hardware control blocks.

Festo Advisory #3 - This advisory discusses four vulnerabilities in the Festo SBRD-Q/SBOC-Q/SBOI-Q series products.

NOTE: I briefly discussed these vulnerabilities on October 2^nd, 2021.

MegaSys Advisory - This advisory describes an OS command injection vulnerability in the MegaSys Telenium Online Web Application.

Updates

Rockwell Update - This update provides additional information on the FLEX 5000 I/O advisory that was originally published on August 14^th, 2025.

NOTE: I described the problem with the incorrect CVE numbers on August 14^th, 2025.

HEIDENHAIN Update - This update provides additional information on the Controller TNC advisory that was originally published on October 25^th, 2022.

Keysight Update - This update provides additional information on the Ixia Vision advisory that was originally published on March 4^th, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-3-updates-published-e07 - subscription required.

Review – 5 Advisories and an Update Published – 7-24-25

Today CISA’s NCCIC-ICS published four control system security advisories for products from LG Innotek, Honeywell, Network Thermostat, and Mitsubishi Electric, as well as a medical device security advisory for products from Medtronic. They also updated an advisory for products from ICONICS/Mitsubishi.

Advisories

LG Advisory - This advisory describes an authentication bypass using an alternate path or channel vulnerability in the LG Innotek camera model LNV510R.

Honeywell Advisory - This advisory describes six vulnerabilities in the Honeywell Experion PKS. The vulnerabilities were reported by Positive Technologies.

Network Thermostat Advisory - This advisory describes a missing authentication for critical function vulnerability in the Network Thermostat X-Series WiFi thermostats.

Mitsubishi Advisory - This advisory discusses an uncontrolled search path element vulnerability in the Mitsubishi CNC Series products.

Medtronic Advisory - This advisory describes three vulnerabilities in the Medtronic MyCareLink Patient Monitors.

Updates

Mitsubishi Update - This update provides additional information on the MC Works64 advisory that was originally published on July 26^th, 2022.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-an-update-published - subscription required.