Review – Public ICS Disclosures – Week of 10-18-25

This week we have bulk vendor disclosures from Moxa (6). There are eight additional vendor disclosures from ABB, Belden, HP (3), Pilz, Sauter, and Zyxel. We also have three vendor updates from ABB (2) and HP.

Bulk Disclosures

Bulk Advisories – Moxa

• CVE-2025-1679, CVE-2025-1680: Stored Cross-site Scripting (XSS) and Host Header Injection Vulnerabilities in Ethernet Switch,

• Security Enhancement: Modbus/TCP Discrete Input Access,

• Security Enhancement: Modbus/TCP Device Identification,

• Security Enhancement: SNMP Agent Default Community Name (public),

• Security Enhancement: SSH Weak MAC Algorithms Enabled, and

• Security Enhancement: SSH Weak Key Exchange Algorithms Enabled.

Advisories

ABB Advisory - ABB published an advisory that describes a heap-based buffer overflow vulnerability in their Terra AC wallbox.

Belden Advisory - Belden published an advisory that discusses the Blast-RADIUS vulnerability. Belden

HP Advisory #1 - HP published an advisory that discusses an out-of-bounds read vulnerability in multiple notebook and desktop PCs.

HP Advisory #2 - HP published an advisory that discusses two vulnerabilities in multiple notebook and desktop PCs.

HP Advisory #3 - HP published an advisory that discusses an out-of-bounds write vulnerability in multiple notebook PCs.

Pilz Advisory - CERT-VDE published an advisory that discusses an integer overflow or wraparound vulnerability (with publicly available exploits) in the Pilz PASvisu Runtime product.

Sauter Advisory - CERT-VDE published an advisory that describes six vulnerabilities in the Sauter modulo 6 devices.

Zyxel Advisory - Zyxel published an advisory that describes two vulnerabilities in their ZLD firewalls.

Updates

ABB Update #1 - ABB published an update that provides additional information on the ALS-mini-S4/S8 IP advisory that was originally published on October 20^th, 2025.

ABB Update #2 - ABB published an update that provides additional information on the CoreSense advisory that was originally published on April 16^th, 2025, and most recently updated on October 10^th, 2025.

HP Update - HP published an update that provides additional information on their AMD Transient Scheduler advisory that was originally published on July 10^th, 2025, and most recently updated on August 15^th, 2025.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-174 - subscription required.

Review – 6 Advisories Published – 3-23-23

Today, CISA’s NCCIC-ICS published six control system security advisories for products from ProPump and Controls, ABB, Schneider Electric, SAUTER, CP Plus and RoboDK.

Advisories

ProPump Advisory - This advisory describes nine vulnerabilities in the ProPump Osprey Pump Controller.

ABB Advisory - This advisory describes two vulnerabilities in the ABB NE843 Pulsar Plus Controller.

Schneider Advisory - This advisory describes eight vulnerabilities in the Schneider Interactive Graphical SCADA System (IGSS).

SAUTER Advisory - This advisory describes five vulnerabilities in the SAUTER EY-modulo 5 Building Automation Stations.

CP Plus Advisory - This advisory describes an insufficiently protected credentials vulnerability in the CP Plus KVMS Pro.

RoboDK Advisory - This advisory describes an incorrect permission assignment for critical resource in the RoboDK robot development kit.

NOTE: This was a relatively bad day for system owners as four of the six vendors had little or no response towards fixing the identified vulnerabilities.

 

For more details about these advisories, including links to researcher reports and exploits, as well as a description of vendor responses, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-published-3-23-23 - subscription required.

Review – 11 Advisories and 1 Update Published – 1-12-23

Today, CISA’s NCCIC-ICS published eleven control system security advisories for products from Siemens (4), Johnson Controls, SAUTER Controls, Panasonic, InHand Networks, RONDS, Sewio, and Hitachi Energy. They also updated a medical device security advisory for products from Philips. Siemens published two other advisories on Tuesday that were not addressed by NCCIC-ICS, I will cover them this weekend.

NOTE: NCCIC-ICS added a notice to each of the four Siemens advisories published today that: “Beginning January 10, 2023, CISA will no longer be updating historical security advisories for Siemens product vulnerabilities. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).” This will result in a significant reduction in the workload for NCCIC-ICS in the week of Cybersecurity Tuesday.

Advisories

Siemens Advisory #1 - This advisory describes a cross-site scripting vulnerability in the Siemens Mendix SAML Module.

Siemens Advisory #2 - This advisory describes a missing immutable root of trust in hardware vulnerability in the Siemens S7-1500 CPU product family.

Siemens Advisory #3 - This advisory describes an improper restriction of operations within the bounds of a memory buffer vulnerability in the Siemens Solid Edge product.

Siemens Advisory #4 - This advisory describes two vulnerabilities in the Siemens Automation License Manager (ALM).

Johnson Controls Advisory - This advisory describes an insufficiently protected credentials vulnerability in the Johnson Controls Metasys ADS/ADX/OAS Servers.

SAUTER Advisory - This advisory describes two vulnerabilities in the SAUTER Controls Nova 200–220 Series (PLC 6).

Panasonic Advisory - This advisory describes a cross-site request forgery vulnerability in versions of the Panasonic Sanyo CCTV Network Camera.

InHand Advisory - This advisory describes five vulnerabilities in the InHand InRouter302 and InRouter615.

RONDS Advisory - This advisory describes two vulnerabilities in the RONDS Equipment Predictive Maintenance (EPM) product.

Hitachi Energy Advisory - This advisory describes an improper access control vulnerability in the Hitachi Energy Lumada Asset Performance Management product.

Updates

Philips Update - This update provides additional information on an advisory that was originally published on November 18^th, 2021.

 

For more details on these advisories, including links to researcher reports, exploits, and a discussion about problems with CVE numbers, see my article to CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published-798 - subscription required.

Review – 4 Advisories Published – 10-27-22

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Trihedral, Rockwell Automation (2), and SAUTER.

Trihedral Advisory - This advisory describes an improper input validation vulnerability in the Trihedral VTScada.

Rockwell Advisory #1 - This advisory discusses nine vulnerabilities (one with a known exploit) in the Rockwell Stratix Devices.

Rockwell Advisory #2 - This advisory describes an improper access control vulnerability in the Rockwell FactoryTalk Alarm and Events Server.

SAUTER Advisory - This advisory describes a cross-site scripting vulnerability in the SAUTER moduWeb.

 

For more details about these advisories, including links to 3^rd party advisories and exploits, see my article in CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-10-27-22 - subscription required.

Four Advisories and One Update Published

Yesterday the DHS NCCIC-ICS published four new control system security advisories for products from Fr. Sauter, Circontrol, Schneider Electric, AVEVA. They also updated a previously published advisory for products from Rockwell.

Sauter Advisory

This advisory describes an improper restriction of XML external entity reference in the Sauter CASE Suite application. The vulnerability was reported by Gjoko Krstic of Applied Risk. Sauter has an update that mitigates the vulnerability. There is no indication that Krstic has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low skilled attacker could remotely exploit the vulnerability to allow an attacker to remotely retrieve unauthorized files from the system.

Circontrol Advisory

This advisory describes two vulnerabilities in the Circontrol CirCarLife electric vehicle charging station. The vulnerabilities were reported by Ankit Anubhav of NewSky Security, M. Can Kurnaz Senior Consultant at KPMG Netherlands, Alim Solmaz Security Consultant at Atos, Michael John Chief Information Security Officer at WePower Network, and Gyorgy Miru Security Researcher at Verint. Circontrol has a new version that mitigates the vulnerability. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Authentication bypass using an alternate path or channel - CVE-2018-17918; and

• Insufficiently protected credentials - CVE-2018-17922

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a remote attacker to retrieve credentials stored in clear text to bypass authentication, and see and access critical information.

Schneider Advisory

This advisory describes a DLL hijacking vulnerability in the Schneider Software Update (SESU) installed with a wide variety of Schneider products. The vulnerability was reported by Haojun Hou of ADLab of Venustech. Schneider has an update that mitigates the vulnerability. There is no indication hat Haojun has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to execute arbitrary code on the target system.

NOTE: I had previously discussed this vulnerability last weekend.

AVEVA Advisory

This advisory describes two vulnerabilities in the AVEVA InduSoft Web Studio and InTouch Edge HMI. These vulnerabilities were reported by Tenable. AVEVA has new versions that mitigate the vulnerabilities. There is no indication that Tenable was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-17916; and

• Empty password in configuration file - CVE-2018-17914

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an unauthenticated user to remotely execute code.

Rockwell Update

This update provides additional information on an advisory that was originally published on October 26^th, 2017. The update provides new mitigation information based upon new limitations on the impact of the vulnerability.

NOTE: This is the KRACK vulnerability advisory for the Rockwell Stratix 5100 Wireless Access Point/Workgroup Bridge.

ICS-CERT Publishes Four Advisories

Today the DHS ICS-CERT published four control system security advisories for products from INTERSCHALT, Adcon, Sauter and Moxa.

INTERSCHALT Advisory

This advisory describes a path traversal vulnerability the INTERSCHALT Maritime Systems (INTERSCHALT) VDR G4e application. The vulnerability was reported by Maxim Rupp. INTERSCHALT has produced a patch to mitigate this vulnerability. ICS-CERT reports that Maxim has verified the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit this vulnerability to read/download arbitrary files from the target host.

Adcon Advisory

This advisory describes a cross-site scripting vulnerability in the Adcon Telemetry A850 Telemetry Gateway Base Station. The vulnerability was reported by the Aditya K. Sood. Adcon has produced a new firmware version to mitigate the vulnerability. There is no indication that Sood has been provided the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to allow the injection of arbitrary JavaScript that may affect the integrity of the system.

Sauter Advisory

This advisory describes an authentication bypass vulnerability in the Sauter NovaWeb web HMI application. The vulnerability was reported by Maxim Rupp. The HMI application is no longer supported so there will be no fix for the vulnerability.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to gain authorized access to the application.

Moxa Advisory

This advisory describes two vulnerabilities in the Moxa MiiNePort. The vulnerabilities were reported by Aditya Sood. Moxa has produced new firmware versions to mitigate the vulnerabilities. There is no indication that Sood was provided an opportunity to verify the efficacy of the fix.

The reported vulnerabilities are:

• Permissions, privileges, and access controls - CVE-2016-9344; and

• Cleartext storage of sensitive information - CVE-2016-9346

ICS-CERT Updates Siemens Advisory and Publishes Two New Advisories

Today the DHS ICS-CERT published an update for a Siemens advisory that was originally published on December 1^st, 2015. Two new advisories were also published for vulnerabilities in control system components from GE and Sauter.

Siemens Update

This update updates the vulnerable device list to provide limiting version numbers. It also announces that firmware updates are now available for SIMATIC TIM 3V-IE, TIM 4R-IE, and CP 443-1 / CP 443-1 Advanced modules. Siemens is still working on updates for a number of other affected devices. Both of the recent updates to the Siemens Security Advisory are covered in today’s update.

As has become usual for ICS-CERT advisory updates, this updated was not listed on the ICS-CERT landing page, but it was reported on TWITTER®.

GE Advisory

This advisory describes twin vulnerabilities in the GE SNMP/Web Interface adapter. The vulnerabilities were reported by Karn Ganeshen. GE has produced a firmware update to fix the vulnerability in newer versions. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Command injection - CVE-2016-0861; and

• Cleartext storage of sensitive information - CVE-2016-0862

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to execute arbitrary system commands.

The GE Product Security Advisory notes that these adapters are used with uninterruptable power supplies.

Sauter Advisory 

This advisory describes three vulnerabilities in the Sauter moduWeb Vision application. The vulnerabilities were reported by Martin Jartelius and John Stock of Outpost24. Sauter has produced a firmware update to fix the vulnerabilities. ICS-CERT reports that the researchers have validated the efficacy of the fix.

The vulnerabilities include:

• Insecure credential storage - CVE-2015-7914;

• Insecure transmission of credentials - CVE-2015-7915; and

• Cross-site scripting - CVE-2015-7916

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to gain system access and escalate privileges.