Review - Public ICS Disclosures – Week of 4-4-26 – Part 2

 For Part 2 we have five additional vendor disclosures from Philips, Siemens, TP-Link (2), and WAGO. There are also two vendor updates from Mitsubishi. There are three researcher reports for products from NI. Finally, we have an exploit for products from ForitGuard. 

Advisories  

Philips Advisory - Philips published an advisory that discusses the ChipSoft ransomware issue. 

Siemens Advisory - Siemens published a bulletin that discuses ‘Increasing Cyber Threats to Industrial Control Systems’. 

TP-Link Advisory #1 - TP-Link published an advisory that describes a previously disclosed authentication bypass by spoofing vulnerability (listed in CISA’s Known Exploited Vulnerabilities catalog) in legacy TP-Link router and access point products. 

TP-Link Advisory #2 - TP-Link published an advisory that describes five vulnerabilities in their AX3000 Dual-Band Gigabit Wi-Fi 6 router. 

WAGO Advisory - CERT-VDE published an advisory that describes a code injection vulnerability in the Web-based management function in multiple WAGO products. 

Updates  

Mitsubishi Update #1 - Mitsubishi published an update for their Information Tampering advisory that was originally published on August 5th, 2025, and most recently updated on September 18th, 2025. 

Mitsubishi Update #2 - Mitsubishi published an update for their Information Tampering advisory that was originally published on May 15th, 2025, and most recently updated on January 8th, 2026. 

Researcher Reports  

NI Reports - Michael Heinzl published three reports about individual vulnerabilities in the LabVIEW product from NI. 

NOTE: I mentioned the associated NI advisory in passing yesterday. 

Exploits  

FortiGuard Exploit - Mohammed Idrees Banyamer published an exploit for a relative path traversal vulnerability in the FortiGuard FortiWeb product. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/publish/posts/detail/193961834/share-center - subscription required. 

Review – 3 Advisories and 1 Update Published – 3-26-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from PTC, OpenCode Systems, and WAGO. They also updated an advisory for products from Honeywell.

Advisories

PTC Advisory - This advisory describes a code injection vulnerability (with available indicators of compromise) in the PTC Windchill and FlexPLM product lifecycle management products.

OpenCode Advisory - This advisory describes an improper access control vulnerability in the OpenCode Systems OC Messaging and USSD Gateway.

WAGO Advisory - This advisory describes the a hidden functionality vulnerability in the WAGO Industrial Managed Switches.

Updates

Honeywell Update - This update provides additional information on the IQ4x BMS Controller advisory that was originally published on March 10^th, 2026.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-4be - subscription required.

Review – Public ICS Disclosures – Week of 2-7-26 – Part 2

 For Part 2 we have five additional vendor disclosures from Arista, HPE, Supermicro, WAGO, and Yokogawa. There are ten vendor updates from Broadcom (3), CODESYS (2), HP, HPE, and Schneider (3). We also have three researcher reports for products from Sante, Linksys, and Solax. Finally, we have three exploits for products from FortiGuard, Palo Alto Networks, and SolarWinds.

Advisories

Arista Advisory - Arista published an advisory that describes six vulnerabilities in their Next Generation Firewall.

HPE Advisory - HPE published an advisory that discusses an improper handling of values vulnerability in their ProLiant DL/ML/XD, Synergy, Edgeline, MicroServer.

Supermicro Advisory - Supermicro published an advisory that discusses 11 vulnerabilities in multiple Supermicro products.

WAGO Advisory - CERT-VDE published an advisory that describes four vulnerabilities in the WAGO Industrial-Managed-Switch 0852-XXXX products.

Yokogawa Advisory - Yokogawa published an advisory that describes six vulnerabilities in their Vnet/IP Interface Package.

Updates

Broadcom Update #1 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on August 1^st, 2023.

Broadcom Update #2 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on May 17^th, 2017.

Broadcom Update #3 - Broadcom published an update for their rsynd advisory that was originally published on September 13, 2022.

CODESYS Update #1 - CODESYS published an update for their CODESYS Control advisory that was originally published on December 1^st, 2025.

CODESYS Update #2 - CODESYS published an update for their CODESYS Control advisory that was originally published on December 1^st, 2025.

HP Update - HP published an update for their LaserJet advisory that was originally published on November 13^th, 2025, and most recently updated on December 10^th, 2025.

HPE Update - HPE published an update for their Aruba Networking EdgeConnect advisory that was originally published on January 14^th, 2026.

Schneider Update #1 - Schneider published an update for their EcoStruxure Power Operation advisory that was originally published on July 8^th, 2025.

Schneider Update #2 - Schneider published an update for their EcoStruxure Foxboro DCS advisory that was originally published on December 9^th, 2025.

Schneider Update #3 - Schneider published an update for their Uni-Telway Driver advisory that was originally published on February 11^th, 2025, and most recently updated on January 13^th, 2026.

Researcher Reports

Linksys Report - SySS Tech published a report that describes six vulnerabilities (with proof-of-concept code) in the Linksys MR9600 and MX4200 routers.

Sante Report - The Zero Day Initiative published a report that describes a buffer overflow vulnerability in the Sante DICOM Viewer Pro.

Solax Report - SEC Consult published a report that describes three vulnerabilities (with proof-of-concept code) in the Solax Power Pocket WiFi models.

Exploits

FortiGuard Exploit - Peter Gabaldon published an exploit for an exposure of sensitive information to an unauthorized actor vulnerability in the FortiGuard FortiGate product.

Palo Alto Networks Exploit - Indoushka published an exploit for four vulnerabilities in the Palo Alto Networks PAN-OS products.

 

For more information about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-c98 - subscription required.

Review – Public ICS Disclosures – Week of 12-6-25 – Part 2

For Part 2 we have nine bulk disclosures from Siemens. There are five additional vendor disclosures from Dell, Pheonix Contact, Schneider (2), and WAGO. There are 14 bulk updates from HP (6) and Siemens (8). We also have three other vendor updates from Hitachi Energy, Moxa, and Schneider. There is a researcher report on vulnerabilities in products from the Biosig Project (6). Finally, we have four exploits for products from Broadcom, Palo Alto Networks, and React Server Components (2).

Bulk Disclosures – Siemens

• Denial of service Vulnerability in Interniche IP-Stack based Industrial Devices,

• Multiple Vulnerabilities in RUGGEDCOM ROX Before V2.17,

• Multiple Vulnerabilities in SINEC Security Monitor before V4.10.0,

• Denial of Service Vulnerability in Ruggedcom ROS devices before V5.10.1,

• File Parsing Vulnerability in Simcenter Femap Before V2512,

• Multiple Vulnerabilities in SICAM T Before V3.0,

• Multiple Vulnerabilities in SIMATIC CN 4100 Before V4.0.1,

• Multiple Vulnerabilities in COMOS, and

• Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0.

Advisories

Dell Advisory - Dell published an advisory that discusses 36 vulnerabilities in their ThinOS product.

Pheonix Contact Advisory - Pheonix Contact published an advisory that describes 14 vulnerabilities in their SWITCH 2xxx Firmware.

Schneider Advisory #1 - Schneider published an advisory that discusses an exposure of sensitive information to unauthorized actor vulnerability in multiple Schneider products.

Schneider Advisory #2 - Schneider published an advisory that discusses a deserialization of untrusted data vulnerability in their EcoStruxure Foxboro DCS Advisor.

WAGO Advisory - CERT-VDE published an advisory that describes two stack-based buffer overflow vulnerabilities in the WAGO Industrial-Managed Switches.

Bulk Updates – HP

• NVIDIA GPU Display Driver October 2025 Security Update,

• NVIDIA GPU Display Driver July 2025 Security Update,

• Certain HP LaserJet Pro Printers – Potential Information Disclosure,

• AMD CPU Microcode Security Update,

• HP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code Execution, and

• Intel System Security Report and System Resources Defense.

Bulk Updates – Siemens

• Deserialization Vulnerability in Siemens Engineering Platforms before V20,

• RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products,

• Deserialization Vulnerability in Siemens Engineering Platforms,

• Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products,

• Deserialization Vulnerability in Siemens Engineering Platforms,

• Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products,

• Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20, and

• DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery.

Updates

Hitachi Energy Update - Hitachi Energy published an update for their Relion 670/650 advisory that was originally published on June 24^th, 2025, and most recently updated on August 26^th, 2025.

Moxa Update - Moxa published an update for their ICMP Timestamp Request advisory that was originally published on October 21^st, 2025, and most recently updated on October 27^th, 2025.

Schneider Update - Schneider published an update for their Altivar Process Drives advisory that was originally published on September 9^th, 2025, and most recently updated on October 14^th, 2025.

Researcher Reports

Biosig Project Report - Cisco Talos published a report that describes six stack-based buffer overflow vulnerabilities in the Biosig Project libbiosig library.

Exploits

Broadcom Exploit - Indoushka published an exploit for an improper restriction of operations within the bounds of a memory buffer vulnerability in the Broadcom Wi-Fi Firmware.

Palo Alto Networks Exploit - Indoushka published an exploit for a deep-packet inspection vulnerability in the PanOS.

RSC Exploit #1 - Indoushka published a scanner for, and an exploit of, the deserialization of untrusted data vulnerability in React Server Components.

RSC Exploit #2 - Maksim Rogov, et al, published a Metasploit module for the the deserialization of untrusted data vulnerability in React Server Components.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-0c5 - subscription required.

Review – Public ICS Disclosures – Week of 11-1-25 – Part 2

For Part 2 this week we have three additional vendor disclosures from WAGO and Westermo (2). We also have four vendor updates from Dell (2), FortiGuard, and Moxa. There are three researcher reports of vulnerabilities in products from Geutebruck and Ilevia (2). Finally, we have an exploit for products from WatchGuard.

Advisories

WAGO Advisory - CERT-VDE published an advisory that discusses three vulnerabilities in multiple WAGO products.

Westermo Advisory #1 - Westermo published an advisory that describes a path traversal vulnerability in their WeOS5 operating system.

Westermo Advisory #2 - Westermo published an advisory that describes a command injection vulnerability in their WeOS 5 operating system.

Vendor Updates

Dell Update #1 - Dell published an update for their EMC Ruckus Wireless Controller advisory that was originally published on December 17^th, 2021.

Dell Update #2 - Dell published an update for their Windows IoT Enterprise LTSC advisory that was originally published on October 31^st, 2025.

FortiGuard Update - FortiGuard published an update for their cw_stad daemon advisory that was originally published on July 8^th, 2025.

Moxa Update - Moxa published an update for their Diffie-Hellman Key Exchange advisory that was originally published on June 2^nd, 2025.

Researcher Reports

Geutebruck Report - Black Lantern Security published a report about an SQL injection vulnerability in the Geutebruck G-Cam Series Cameras.

Ilevia Reports - Zero Science published three reports about vulnerabilities in the Ilevia EVE X1/X5 Server.

Exploits

WatchGuard Exploit - Chanakya Neelarapu and Mark Gibson published an exploit for a use of default credentials vulnerability in the Watch Guard Firebox devices.

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-42e - subscription required.

Review – Public ICS Disclosures – Week of 9-20-25

This week we have nine vendor disclosures from Delta Electronics, Honeywell, HP (3), HPE, Philips, Rockwell, and WAGO. There are also three vendor updates from HPE, WAGO, and Welotec.

Advisories

Delta Advisory - Delta published an advisory that describes two stack-based buffer overflow vulnerabilities in their CNCSoft-G2 product.

Honeywell Advisory - Honeywell published an end-of-life notice for the legacy integrations in their Pro-Watch product.

HP Advisory #1 - HP published an advisory that discusses seven vulnerabilities in multiple HP product lines.

HP Advisory #2 - HP published an advisory that discusses six vulnerabilities (with publicly available exploits) in multiple PC product lines.

HP Advisory #3 - HP published an advisory that discusses four vulnerabilities in multiple product lines.

HPE Advisory - HPE published an advisory that discusses an out-of-bounds read vulnerability in their HPE Superdome Flex and Compute Scale-up Server 3200.

Philips Advisory - Philips published an advisory that discusses the Shai-Hulud worm.

Rockwell Advisory - Rockwell published an advisory that discusses a stack-based buffer overflow vulnerability in their Stratix products.

WAGO Advisory - CERT-VDE published an advisory that describes two missing authentication for critical function vulnerabilities in the WAGO Software Device Sphere and Software Solution Builder.

Updates

HPE Update - HPE published an update for their Blast-RADIUS advisory that was originally published on July 9^th, 2024, and most recently updated on January 22nc, 2025.

WAGO Update - CERT-VDE published an update for the WAGO 750-8xx Controller advisory that was originally published on August 17^th, 2018, and most recently updated on May 22^nd, 2025.

Welotec Update - CERT-VDE published an update for the Welotec SmartEMS Upload advisory that was originally published on September 10^th, 2025.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-0a8 - subscription required.

Review – Public ICS Disclosures – Week of 9-13-25 – Part 2

For Part 2 we have six additional vendor disclosures from Mitsubishi, Omron, Siemens, Supermicro, WAGO, and WatchGuard. Finally, we have nine vendor updates from ABB, HP (2), HPE (3), and Mitsubishi (3).

Advisories

Mitsubishi Advisory - Mitsubishi published an advisory that describes an improper handling of length parameter inconsistency vulnerability in their MELSEC-Q series CPU module.

Omron Advisory - Omron published an advisory that describes an unquoted search path element vulnerability in multiple Omron products.

Siemens Advisory - Siemens published an advisory that discusses a weak authentication vulnerability in their Trainguard products.

NOTE: I briefly discussed this vulnerability on July 10^th, 2025.

Supermicro Advisory - Supermicro published an advisory that describes two improper verification of cryptographic signature vulnerabilities in their BMC firmware.

WAGO Advisory - CERT-VDE published an advisory that describes an insecure default initialization of resource vulnerabilities in multiple WAGO products.

WatchGuard Advisory - WatchGuard published an advisory that describes an out-of-bounds write vulnerability in their Fireware OS iked process.

Updates

ABB Updates - ABB published an update for their FLXeon Controllers advisory that was originally published on September 9^th, 2025.

HP Update #1 - HP published an update for their Intel 2025.1 IPU – Chipset advisory that was originally published on March 10^th, 2025, and most recently update on August 1^st, 2025.

HP Update #2 - HP published an update for their Intel Graphics Driver advisory that was originally published on May 13^th, 2025.

HPE Update #1 - HPE published an update for their ProLiant DL/ML/XD advisory that was originally published on August 14^th, 2025.

HPE Update #2 - HPE published an update for their ProLiant DL/ML/XD advisory that was originally published on August 14^th, 2025.

HPE Update #3 - HPE published an update for their Intel 700 Series advisory that was originally published on August 12^th, 2025.

Mitsubishi Update #1 - Mitsubishi published an update for their GENESIS64 advisory that was originally published on August 5^th, 2025.

Mitsubishi Update #2 - Mitsubishi published an update for their EcoGuideTAB advisory that was originally published on July 10^th, 2025.

Mitsubishi Update #3 - Mitsubishi published an update for their GENESIS64 advisory that was originally published on May 15^th, 2025, and most recently updated on August 5^th, 2025.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-ac4 - subscription required.

Review – Public ICS Disclosures – Week of 9-6-25 – Part 2

For Part 2 this week we have ten additional vendor disclosures from Philips, Phoenix Contact (2), Schneider (2), WAGO (3), Welotec, and Western Digital. We have bulk updates from Siemens (8). Finally, we have three other vendor updates from ABB.

Advisories

Philips Advisory - Philips published an advisory that discusses the Windows 10 end-of-life notice from Microsoft.

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory that discusses two vulnerabilities in their FL MGUARD product.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory that discusses a least privilege vulnerability in multiple Phoenix Contact products.

Schneider Advisory #1 - Schneider published an advisory that discusses a cross-site scripting vulnerability in their Altivar Process Drives and Communication Modules.

Schneider Advisory #2 - Schneider published an advisory that describes two vulnerabilities in their Saitel DR & Saitel DP remote terminal units.

WAGO Advisory #1 - CERT-VDE published an advisory that describes a missing authentication for critical function vulnerability in multiple WAGO products.

WAGO Advisory #2 - CERT-VDE published an advisory that describes an incorrect permission assignment for critical resource vulnerability in multiple WAGO products.

WAGO Advisory #3 - CERT-VDE published an advisory that discusses an inclusion of functionality from untrusted control sphere vulnerability in multiple WAGO products.

Welotec Advisory - CERT-VDE published an advisory that describes a path traversal vulnerability in the Welotec SmartEMS Web Application.

Western Digital Advisory - Western Digital published an advisory that describes a root code execution vulnerability in their Acronis True Image for Western Digital (macOS).

Bulk Updates – Siemens

• Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices,

• Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products,

• Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products,

• Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP,

• Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices,

• Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products,

• DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery, and

• Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Updates

ABB Update #1 - ABB published an update for their RTU500 series advisory that was originally published on March 25, 2025, and most recently update on April 29^th, 2025.

ABB Update #2 - ABB published an update for their RTU500 series advisory that was originally published on April 30^th, 2024.

ABB Update #3 - ABB published an update for their RTU500 series advisory that was originally published on 26 March, 2024, and most recently updated on December 18^th, 2024.

 

For more information on these disclosures, including links to researcher reports, 3^rd party advisories, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-735 - subscription required.

Review – Public ICS Disclosures – Week of 4-12-25

This week we have 14 vendor disclosures from ads-tech, Broadcom, Delta Electronics, GE Vernova (2), HP, HPE (2), Philips, Rockwell Automation, SEL (3), and WAGO. There are two vendor updates from Broadcom and Siemens. We also have three researcher reports for vulnerabilities in products from Eclipse. Finally, we have two exploits for products from Ruckus and FortiGuard.

Advisories

Ads-tech Advisory - CERT-VDE published an advisory that discusses three vulnerabilities (two with publicly available exploits) in the ads-tech IRF products.

Broadcom Advisory - Broadcom published an advisory that describes an input validation vulnerability in multiple Brocade products.

Delta Advisory - Delta published an advisory that describes three vulnerabilities in their ISPsoft product.

GE Advisory #1 - GE Vernova published an advisory that discusses four vulnerabilities in their NetworkST4 devices and Remote Operations Offering products.

GE Advisory #2 - GE Vernova published an advisory that discusses three vulnerabilities (all three listed in CISA’s KEV catalog) in unspecified GE products.

HP Advisory - HP published an advisory that describes a link following vulnerability in their Touchpoint Analytics Service.

HPE Advisory #1 - HPE published an advisory that describes an unauthorized access vulnerability in their Performance Cluster Manager.

HPE Advisory #2 - HPE published an advisory that describes an unauthorized access vulnerability in their Cray Data Virtualization Service.

Philips Advisory - Philips published an advisory that discusses a use after free vulnerability (with publicly available exploit) in multiple Philips products.

Rockwell Advisory - Rockwell published an advisory that describes two vulnerabilities in their ThinManager product.

SEL Advisory #1 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5032 acSELerator Architect Software.

SEL Advisory #2 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5702 Synchrowave Operations product.

SEL Advisory #3 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5231 SEL Configuration API.

WAGO Advisory - CERT-VDE published an advisory that discusses the Year 2038 problem.

Updates

Broadcom Update - Broadcom published an update for their Fabric OS advisory that was originally published on September 26^th, 2034, and most recently updated on February 27^th, 2025.

Siemens Update - Siemens published an update for their Industrial Edge Device Kit advisory that was originally published on April 8^th, 2025.

Researcher Reports

Eclipse Reports - Cisco Talos published three reports about individual vulnerabilities in the Eclipse ThreadX NetX Duo HTTP server.

Exploits

Ruckus Exploit - Korelogic published an exploit for an undocumented backdoor vulnerability in the Ruckus IoT Controller.

FortiGuard Exploit - Zach Hanley published a Metasploit module for an improper authentication vulnerability (listed in CISA’s KEV catalog) in multiple FortiGuard products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-971 - subscription required.