Review – Public ICS Disclosures – Week of 11-22-25 – Part 2

For Part 2 we have three additional vendor disclosures from ABB, and Wibu (2). There are also six vendor updates from ABB, FortiGuard (2), and Mitsubishi (3). Finally, we have five exploits for products from Broadcom, FortiGuard (2), HP, and Ruckus.

Advisories

ABB Advisory - ABB published an advisory that discusses 22 vulnerabilities in their Ability Camera Connect product.

Wibu Advisory #1 - Wibu published an advisory that describes a write-what-where condition vulnerability in their legacy WibuKey product.

Wibu Advisory #2 - Wibu published an advisory that describes an improper restriction of operations within the bounds of a memory buffer vulnerability in their legacy WibuKey product.

Updates

ABB Update - ABB published an update for their Terra AC wallbox advisory that was originally published on September 16^th, 2025, and most recently updated on October 27^th, 2025.

FortiGuard Update #1 - FortiGuard published an update for their CAPWAP daemon advisory that was originally published on November 18^th, 2025.

FortiGuard Update #2 - FortiGuard published an update for their CAPWAP daemon advisory that was originally published on November 18^th, 2025.

Mitsubishi Update #1 - Mitsubishi published an update for their Lighting Control System MILCO.S advisory that was originally published on November 18^th, 2025.

Mitsubishi Update #2 - Mitsubishi published an update for their Flexera InstallShield advisory that was originally published on July 24^th, 2025.

Exploits

Broadcom Exploit - Indoushka published an exploit for two vulnerabilities in the Broadcom Brocade Fabric OS.

FortiGuard Exploit #1 - Indoushka published an exploit for a relative path traversal vulnerability in the FortiGuard FortiWeb product.

FortiGuard Exploit #1 - Sfewer-r7 published a Metasploit module for two vulnerabilities in the FortiGuard FortiWeb product.

HP Exploit - Indoushka published an exploit for an improper authentication vulnerability in the HP Intelligent Management product.

Ruckus Exploit - Huthaifa Qashou published an exploit for a cross-site scripting vulnerability in the Ruckus Unleashed product.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-f10 - subscription required.

Review – Public ICS Disclosures – Week of 8-12-23

This week we have 17 vendor disclosures from Aruba Networks, Broadcom, CODESYS, FortiGuard, GE Gas Power, Helmholz, HPE (2), Inductive Automation, Moxa (2), Palo Alto Networks, Red Lion, Rockwell, Ruckus Wireless, Wibu, and Zyxel.

Advisories

Aruba Advisory - Aruba published an advisory that describes two vulnerabilities in their Virtual Intranet Access (VIA) Windows Client.

Broadcom Advisory - Broadcom published an advisory that discusses a type confusion vulnerability in their Brocade Fabric OS product.

CODESYS Advisory - CODESYS published an advisory that discusses a heap-based buffer overflow vulnerability in multiple products.

FortiGuard Advisory - FortiGuard published an advisory that describes a stack-based buffer overflow vulnerability in their FortiOS product.

GE Gas Power - GE published an advisory that discusses a heap-based buffer overflow vulnerability in their CIMPLICITY product.

Helmholz Advisory - CERT-VDE published an advisory that discusses a cross-site scripting vulnerability in their REX 200 and REX 250 products.

HPE Advisory #1 - HPE published an advisory that discusses 13 vulnerabilities in their HP-UX Web Server Suite Software.

HPE Advisory #2 - HPE published an advisory that discusses two vulnerabilities in their SimpliVity Servers.

Inductive Automation Advisory - Inductive Automation published an advisory that describes six vulnerabilities in their Ignition product.

Moxa Advisory #1 - Moxa published an advisory that describes a use of hard-coded credentials vulnerability in their NPort IAW5000A-I/O Series.

Moxa Advisory #2 - Moxa published an advisory that describes eight vulnerabilities in their TN-5900 and TN-4900 Series Web Server.

Palo Alto Networks Advisory - Palo Alto Networks published an advisory that discusses the TunnelCrack vulnerabilities.

Red Lion Europe Advisory - CERT-VDE published an advisory that descries a cross-site scripting vulnerability in the Red Lion mbNET and mbNET/.rokey.

Rockwell Advisory - Rockwell published an advisory that describes three improper input validation vulnerabilities in their ThinManager ThinServer product.

Ruckus Advisory - Ruckus published an advisory that describes three cross-site scripting vulnerabilities in their ICX product line.

Wibu Advisory - Wibu published an advisory that describes a heap-based buffer overflow vulnerability in their CodeMeter Runtime product.

Zyxel Advisory #1 - Zyxel published an advisory that describes an improper handling of exceptions vulnerability in their XGS2220, XMG1930, and XS1930 series switches.

Zyxel Advisory #2 - Zyxel published an advisory that describes an OS command injection vulnerability in their NBG6604 home router.

 

For more information about the disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-810 - subscription required.

Review – 11 Updates Published – 3-10-22

Yesterday, CISA’s NCCIC-ICS updated eleven control-system security advisories for products from Wibu Systems, PTC, and Siemens (9). Siemens published eight additional updates on Tuesday which I will address this weekend.

Wibu-Systems Update - This update provides additional information on an advisory that was originally published on September 8^th, 2020 and most recently updated on February 11^th, 2021.

PTC Update - This update provides additional information on an advisory that was originally published on March 8^th, 2022.

NOTE: There is a typo in the link for the Agilent advisory provided in the Update.

Industrial Products Update #1 - This update provides additional information on an advisory that was originally published on September 10^th, 2019 and most recently updated on September 14^th, 2021.

Industrial Products Update #2 - This update provides additional information on an advisory that was originally published on September 8^th, 2020 and most recently updated on June 8^th, 2021

Industrial Products Update #3 - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

SIMOTICS Update - This update provides additional information on an advisory that was originally published on April 13^th, 2021.

Climatix Update - This update provides additional information on an advisory that was originally published on November 11^th, 2021.

SIMATIC Update #1 - This update provides additional information on an advisory that was originally published on November 11^th, 2021 and most recently updated on February 10^th, 2022.

SIMATIC Update #2 - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

Solid Edge Update - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

SICAM Update - This update provides additional information on an advisory that was originally published on February 10^th, 2022.

 

For more information on these updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-updates-published-3-10-22 - subscription required.

Review - 20 Advisories Published – 12-16-21

Today, CISA’s NCCIC-ICS published 20 control system security advisories for products from Siemens (15), Mitsubishi Electric (2), Wibu Systems, Delta Electronics, and Xylem. They also published six updates; I will cover these in a separate post. All of the new advisories that Siemens published on Tuesday were covered today by NCCIC-ICS.

JTTK Advisory #1 - This advisory describes two vulnerabilities in the Siemens JTTK and JT Utilities.

NOTE: The Siemens advisory reports ZDI-Canada reference numbers for these two vulnerabilities. Those, in turn point to Bentley CVE’s; CVE-2021-34878, CVE-2021-34898, and CVE-2021-34937 (links are to ZDI reports, CVE’s are still ‘Reserved’). There are a total of 77 ZDI reports for a variety of vulnerabilities in the Bentley View CAD product.

SiPass Advisory - This advisory describes three separate exposure of resources to wrong sphere vulnerabilities in the Siemens SiPass Integrated.

Teamcenter Advisory - This advisory describes a path traversal vulnerability in the Siemens Teamcenter Active Workspace.

JT Utilities Advisory - This advisory describes 16 vulnerabilities in the Siemens JT Utilities, JT Open Toolkit.

Healthineers Advisory - This advisory describes two separate out-of-bounds write vulnerability in the Siemens Healthineers syngo fastView.

NOTE: This should be a medical device security advisory; syngo fastView is a standalone viewer for DICOM2 images.

Simcenter Advisory - This advisory describes an out-of-bounds write vulnerability in the Siemens Simcenter STAR-CCM+ Viewer.

Siveillance Advisory - This advisory describes three separate exposure of resource to wrong sphere vulnerabilities in the Siemens Siveillance Identity self-service portal.

Questa Advisory - This advisory describes an insufficiently protected credential vulnerability in the Siemens Questa Simulation and ModelSim Simulation integrated circuit simulators.

NOTE: The research paper reporting this vulnerability is entitled: “How Not to Protect Your IP – An Industry-Wide Break of IEEE 1735 Implementations”. This vulnerability is not limited to these two Siemens products.

SIMATIC ITS Advisory - This advisory describes a using components with (19) known vulnerabilities vulnerability in the Siemens IMATIC ITC Products.

SIMATIC Advisory - This advisory describes a path traversal vulnerability in the Siemens SIMATIC eaSie PCS 7 Skill Package.

JT2Go Advisory - This advisory describes 16 vulnerabilities in the Siemens JT2Go and Teamcenter Visualization products.

SINUMERIK Advisory - This advisory describes an improper certificate validation vulnerability in the Siemens SINUMERIK Edge platform.

JTTK Advisory #2 - This advisory describes three vulnerabilities in the Siemens JTTK and JT Utilities.

Power Meter Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Siemens POWER METER SICAM Q100.

Capital VSTAR Advisory - This advisory discusses the NUCLEUS:13 vulnerabilities in the Siemens Capital VSTAR.

FA Engineering Advisory - This advisory describes two vulnerabilities in the Mitsubishi FA Engineering Software.

GX Works2 Advisory - This advisory describes an improper handling of length parameter inconsistency vulnerability in the Mitsubishi GX Works2 engineering software suite.

NOTE: Mitsubishi published another advisory and 1 update today. I will address those this weekend.

Wibu Advisory - This advisory describes an improper privilege management vulnerability in the Wibu CodeMeter.

NOTE: I briefly discussed this vulnerability in early October 2021.

Delta Advisory - This advisory describes an out-of-bounds read vulnerability in the Delta CNCSoft industrial automation software.

Xylem Advisory - This advisory describes a use of hard-coded credentials vulnerability in the Xylem AquaView SCADA system.

For more details on these advisories, including links to third-party advisories, exploits and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/20-advisories-published-12-16-21 - subscription required.

Review – Public ICS Disclosures – Week of 10-2-21

This week we have six vendor disclosures from Aruba Networks, Bosch, Lenze, ENDRESS+HAUSER, HPE (2), and WIBU. There is also one researcher report on products from Johnson Controls.

Aruba Advisory - Aruba published an advisory describing six vulnerabilities in their Aruba Instant Access Points product.

Bosch Advisory - Bosch published an advisory describing four vulnerabilities in their Rexroth IndraMotion MLC and IndraLogic XLC products.

Lenze Advisory - CERT-VDE published an advisory discussing three vulnerabilities in a range of products from Lenze.

ENDRESS+HAUSER Advisory - CERT-VDE published an advisory discussing a stack-based buffer overflow vulnerability in the ENDRESS+HAUSER Promass 83 product.

HPE Advisory #1 - HPE published an advisory describing two vulnerabilities in their NonStop SSL Toolkit.

HPE Advisory #2 - HPE published an advisory describing an arbitrary code execution vulnerability in their HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage Arrays products.

WIBU Advisory - WIBU published an advisory describing a denial-of-service vulnerability in their CodeMeter Runtime for Windows product.

Johnson Controls Report - Tenable published a report about two vulnerabilities in the Johnson Controls exacqVision products.

For more details about these advisories, including links to third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10 - subscription required.

Review - 2 Advisories and 1 Update Published – 7-29-21

Today, CISA’s NCCIC-ICS published two control system security advisories for products from WIBU and Hitachi ABB Power Grids. They also published an update for an advisory for products from Mitsubishi.

WIBU Advisory - This advisory describes two buffer over-read vulnerabilities in the WIBU CodeMeter Runtime Server.

Hitachi ABB Advisory - This advisory describes an insufficiently protected credentials vulnerability in the Hitachi ABB Power Grids eSOMS product.

Mitsubishi Update - This update provides additional information on an advisory that was originally published on February 18^th, 2021 and most recently updated on May 27^th, 2021.

For more detail on the advisories, including links to proof-of-concept code, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-1-update-published-809 - subscription required.

Review - Public ICS Disclosures – Week of 6-12-21

This week we have eight vendor disclosures from Digitek, EIP Stack Group, Genetec, QNAP (2), VMware, and Wibu (2). We also have two vendor updates from Dell and Mitsubishi. Finally, we have an exploit for products from Wibu.

Vendor Disclosures

Digitek Advisory - Incibe-CERT published an advisory describing an SQL injection vulnerability in the Digitek Secure 8 system.

EIP Stack Group Advisory - Incibe-CERT published an advisory describing an out-of-bounds read vulnerability in the EIP Stack Group OpENer product.

Genetec Advisory - Genetec published an advisory discussing vulnerabilities in Bosch IP cameras that may affect their Security Center, Security Center SaaS Edition, and Stratocast products.

QNAP Advisory - QNAP published an advisory describing an insecure storage of sensitive information vulnerability in their QNAP NAS products running myQNAPcloud Link.

QNAP Advisory - QNAP published an advisory describing an out-of-bounds read vulnerability in their QNAP NAS products running QTS and QuTS hero.

VMware Advisory - VMware published an advisory describing a denial-of-service vulnerability in their VMware Tools for Windows product.

Wibu Advisory - Wibu published an advisory describing a buffer over-read vulnerability in their CodeMeter Runtime Network Server.

Wibu Advisory - Wibu published an advisory describing a denial-of-service vulnerability in their CodeMeter Runtime CmWAN Server.

Vendor Updates

Dell Update - Dell published an update for their Dell Wyse Windows Embedded System that was originally published on May 11^th, 2021.

Mitsubishi Update - Mitsubishi published an update for their MC Works advisory that was originally published on June 18^th, 2020 and most recently updated on January 14^th, 2021.

Exploits

Wibu Exploit - Brian Rodriquez published an exploit for a unquoted service path vulnerability in the Wibukey Runtime product.

 

For a more detailed look at these disclosures see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-dda (subscription required),

2 Advisories and 1 Update Published – 2-11-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from Rockwell and multiple embedded TCP/IP stacks.

Rockwell Advisory

This advisory describes an uncontrolled search path element vulnerability in the Rockwell DriveTools SP and Drives AOP. The vulnerability was reported by Claroty and Cognite, Rockwell has an update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with local access could exploit the vulnerability resulting in privilege escalation and complete control of the system.

TCP/IP Stacks Advisory

This advisory describes nine separate use of insufficiently random values vulnerabilities in multiple open-source and proprietary TCP/IP stacks. The vulnerabilities (nicknamed NUMBER:JACK) were reported by Daniel dos Santos, Stanislav Dashevskyi, Jos Wetzels, and Amine Amri of Forescout Research Labs. Some the affected vendors have new versions that mitigate the vulnerability in their TCP/IP stack.

The nine reported CVE’s (each generally associated with a separate TCP/IP stack vendor) are:

• CVE-2020-27213 - Nut/Net 5.1 - Patch in progress

• CVE-2020-27630 - uC/TCP-IP 3.6.0 - Patched in the latest version of Micrium OS (successor project),

• CVE-2020-27631 - CycloneTCP 1.9.6 - Patched in version 2.0.0,

• CVE-2020-27632 - NDKTCPIP 2.25 - Patched in version 7.02 of Processor SDK,

• CVE-2020-27633 - FNET 4.6.3 - Documentation updated to warn users and recommend implementing their own PRNG [pseudorandom number generator],

• CVE-2020-27634 - uIP 1.0 Contiki-OS 3.0 Contiki-NG 4.5 - No response from maintainers,

• CVE-2020-27635 - PicoTCP 1.7.0 PicoTCP-NG - Version 2.1 removes the default (vulnerable) implementation and recommends users implement their own PRNG,

• CVE-2020-27636 - MPLAB Net 3.6.- Patched in version 3.6.4.

• CVE-2020-28388 Nucleus NET 4.3 -Patched in Nucleus NET 5.2 and Nucleus ReadyStart v2012.12.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to hijack or spoof TCP connections, cause denial-of-service conditions, inject malicious data, or bypass authentication.

NOTE: The “NUMBER:JACK” report explains that “Forescout Research Labs has released an open source script that uses active fingerprinting to detect which stack a target device is running.” {pg 6}.

Commentary: Oh this is going to be a fun one. I foresee lots of equipment vendor advisories in the works as everyone scrambles to try to fix this mess. BTW, the Report notes that an attack on this type of vulnerability in the old IT world was known as a Mitnick Attack.

CodeMeter Update

This update provides new information on an advisory that was originally published on September 8^th, 2020 and most recently updated on December 3^rd, 2020. The new information includes adding links to the vendor alert from Drager.

Public ICS Disclosures – Week of 1-2-21

This week we have six vendor disclosures from Siemens Healthineers, PEPPERL+FUCHS, Johnson and Johnson, Meinberg, Ruckus, and WIBU systems. There is an updated disclosure from HMS. Finally, there is a researcher report on vulnerabilities in products from Rockwell Automation.

Siemens Advisory

Siemens published an advisory describing a third-party (Telerik UI) java script deserialization vulnerability in their syngo.via software. The vulnerability was reported by Ryan Wincey from Securifera and Austin Nuttal. Siemens has patches for some of the affected versions. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NOTE: There are exploits available (here and here) for the underlying Telerik vulnerability.

PEPPERL+FUCHS Advisory

CERT VDE published an advisory describing six vulnerabilities in the PEPPERL+FUCHS Comtrol IO-Link Master product. The vulnerabilities were reported by T. Weber of SEC Consult Vulnerability Lab. PEPPERL+FUCHS has new versions that mitigate the vulnerabilities. There is no indication that Weber has been provide an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Cross-site scripting (2) - CVE-2020-12511 and CVE-2020-12512,

• OS Command injection - CVE-2020-12513,

• Null pointer dereference - CVE-2020-12514,

• Out-of-bounds read - CVE-2018-20679, and (CISCO vuln, exploit available)

• Key management errors - CVE-2018-0732 (OpenSSL vuln)

Johnson and Johnson Advisory

Johnson and Johnson published an advisory announcing a new version of the Biosense Webster CARTO® 3 Systems that provides mitigation measures for a number of third-party (Windows OS) vulnerabilities.

Meinberg Advisory

Meinberg published an advisory describing a third-party (OpenSSL) null pointer dereference vulnerability in their LANTIME firmware. This vulnerability is self-reported. Meinberg has new versions that mitigate the vulnerability.

Ruckus Advisory

Ruckus published an advisory describing an arbitrary file read vulnerability in their Access Point products. The vulnerability is self-reported. Ruckus has new firmware versions available that mitigate the vulnerability.

WIBU Systems Advisory

WIBU Systems published an advisory describing three third-party (XStream) vulnerabilities in their AxProtector for Java product. The vulnerabilities are self-reported. They note that the AxProtector for Java is not affected itself by any of these vulnerabilities because a whitelist is used, but they are providing an update that mitigates the XStream vulnerabilities. Exploits are available for all three vulnerabilities at the links below.

The three reported vulnerabilities are:

• Command injection - CVE-2020-26217,

• Server-side request forgery - CVE-2020-26258, and

• OS command injection - CVE-2020-26259

HMS Update

HMS published an update of their Amnesia:33 vulnerabilities advisory that was originally published on December 11^th, 2020. The new information includes adding additional products to the ‘confirmed not affected’ list.

Rockwell Report

Talos published a report describing a denial-of-service vulnerability in the Rockwell RSLinx classic ethernet/IP server. This is a coordinated disclosure, but Rockwell has not yet published an advisory describing this vulnerability. The Talos report contains proof-of-concept code.

1 Advisory and 2 Updates Published – 12-3-20

Today the CISA NCCIC-ICS published one control system security advisory for products from National Instruments. They also updated two advisories for products from Wibu-Systems and WECON.

National Instruments Advisory

This advisory describes an incorrect permission assignment for critical resource vulnerability in the National Instruments CompactRIO real-time embedded industrial controller. The vulnerability was reported by Titanium Industrial Security via Incibe CERT. National Instruments has a new driver that mitigates the vulnerability. There is no indication that researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to  allow an attacker to reboot the device remotely.

CodeMeter Update

This update provides additional information on an advisory that that  was originally published on September 8^th, 2020 and most recently updated on October 15^th, 2020. The new information includes links to vendor advisories for products from:

• Eaton, and

• TRUMPF

NOTE: I briefly discussed the Eaton advisory back in early October and the TRUMPF advisory later that month. NCCIC-ICS has not yet mentioned the ENDRESS+HAUSER advisory that I mentioned in the same blog post as the TRUMPF advisory.

WECON Update

This update provides additional information on an advisory that was originally published on August 25, 2020 and most recently updated on October 29^th, 2020. The new information includes:

• Adding a new vulnerability (heap-based buffer overflow - CVE-2020-25199), and

• Adding a new reporting researcher (Peter Cheng from Elex Cybersecurity Inc)

1 Update Published – 10-1-20

 Today the CISC NCCIC-ICS published a control system security update for the CodeMeter vulnerabilities from Wibu-Systems.

CodeMeter Update

This update provides additional information that was originally published on September 8^th, 2020 and most recently updated on September 17^th, 2020. The new information includes links to new affected vendor disclosures from:

ABB,

Bosch, and

COPA-DATA

NOTE: The ABB link is to their Alerts and Notifications page. There are currently four CodeMeter advisories listed on that page. One is a generic advisory and the other three are product specific advisories. I briefly described this in a blog post on September 12^th. I briefly discussed the Bosch advisory on September 26^th

2 Advisories and 1 Update Published – 9-17-20

 Today the CISA NCCIC-ICS published one control system security advisory for products from Advantech, a medical device security advisory for products from Philips, and updated an advisory for products from WIBU-Systems.

Advantech Advisory

This advisory describes an incorrect permission assignment for critical resource vulnerability in the Advantech WebAccess Node HMI platform. The vulnerability was reported by Mat Powell via the Zero Day Initiative. Advantech has a new update that mitigates the vulnerability. There is no indication that Powell has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to escalate their privileges.

Philips Advisory

This advisory describes five vulnerabilities in the Philips Clinical Collaboration Platform. The vulnerabilities were reported by Northridge Hospital Medical Center. Philips has a patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Cross-site request forgery - CVE-2020-14506,

• Improper neutralization of script in attributes in a web page - CVE-2020-14525,

• Protection mechanism failure - CVE-2020-16198,

• Algorithm downgrade - CVE-2020-16200, and

• Configuration - CVE-2020-16247

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to allow an attacker to trick a user into executing unauthorized actions or provide the attacker with identifying information that could be used for subsequent attacks.

WIBU-Systems Update

This update provides additional information on an advisory that was originally published on September 8^th, 2020. The new information includes:

• Affected version information,

• Links to additional affected vendor advisories for:

◦ CODESYS,

◦ PEPPERL+FUCHS,

◦ PILZ,

◦ Phoenix Contact, and

◦ WAGO

NOTE: I identified all but the CODESYS advisory in a post last weekend. In addition, I also noted that ABB published four CodeMeter advisories.