CISA.gov
1 month ago

1. EXECUTIVE SUMMARY
  • CVSS v3 8.8
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: ABB
  • Equipment: ACS880 Drives with IEC 61131-3 license
  • Vulnerabilities: Improper Input Validation, Out-of-bounds Write, Improper Restriction of Operations within the Bounds of a Memory Buffer
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to gain full access to the device or cause a denial-of-service condition.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

ABB reports that the following low-voltage DC drive and power controller products contain a vulnerable version of CODESYS Runtime:

  • ABB ACS880 Drives ACS880 Primary Control Program AINLX: Versions prior to v3.47
  • ABB ACS880 Drives ACS880 Primary Control Program YINLX: Versions prior to v1.30
  • ABB ACS880 Drives ACS880 IGBT Supply Control Program AISLX: Versions prior to v3.43
  • ABB ACS880 Drives ACS880 IGBT Supply Control Program ALHLX: Versions prior to v3.43
  • ABB ACS880 Drives ACS880 IGBT Supply Control Program YISLX: Versions prior v1.30
  • ABB ACS880 Drives ACS880 IGBT Supply Control Program YLHLX: Versions prior v1.30
  • ABB ACS880 Drives ACS880 Position Control Program APCLX: Versions up to and including v1.04.0.5
  • ABB ACS880 Drives ACS880 Test Bench Control Program ATBLX: Versions up to and including v3.44.0.0
3.2 VULNERABILITY OVERVIEW 3.2.1

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.2

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.3

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer which can lead to a denial-of-service condition

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.4

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.5

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.6

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.7

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.8

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.9

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.10

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.11

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.12

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.13

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.14

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.15

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.

has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Switzerland
3.4 RESEARCHER

ABB PSIRT reported these vulnerabilities to CISA.

4. MITIGATIONS

ABB has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • ACS880 Primary Control Program AINLX, ACS880 Primary Control Program YINLX, ACS880 IGBT Supply Control Program AISLX, ACS880 IGBT Supply Control Program ALHLX, ACS880 IGBT Supply Control Program YISLX, ACS880 IGBT Supply Control Program YLHLX: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that users apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please set parameter 196.102 to bit 2 to disable file download for further bit description, please refer to
  • ACS880 Position Control Program APCLX, ACS880 Test Bench Control Program ATBLX: For situations where firmware update is not feasible, please set parameter 196.102 to bit 2 to disable file download, for further bit description, please refer to

The following product versions have been fixed:

  • ACS880 Primary Control Program AINLX: Versions v3.47 and later are fixed versions for CVE-2023-37559, CVE-2022-4046, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2023-37555, CVE-2023-37554, CVE-2023-37553, CVE-2023-37552, CVE-2023-37549, CVE-2023-37550, CVE-2023-37548, CVE-2023-37547, CVE-2023-37546, CVE-2023-37545.
  • ACS880 Primary Control Program YINLX: Versions v1.30 and later are fixed versions for CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2022-4046, CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550, CVE-2023-37552, CVE-2023-37553, CVE-2023-37554, CVE-2023-37555.
  • ACS880 IGBT Supply Control Program AISLX: Versions v3.43 and later are fixed versions for CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2023-37555, CVE-2023-37554, CVE-2023-37553, CVE-2023-37552, CVE-2023-37550, CVE-2023-37549, CVE-2023-37548, CVE-2023-37547, CVE-2023-37546, CVE-2023-37545, CVE-2022-4046.
  • ACS880 IGBT Supply Control Program ALHLX: Versions v3.43 and later are fixed versions for CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2023-37555, CVE-2023-37554, CVE-2023-37553, CVE-2023-37552, CVE-2023-37550, CVE-2023-37549, CVE-2023-37548, CVE-2023-37547, CVE-2023-37546, CVE-2023-37545, CVE-2022-4046.
  • ACS880 IGBT Supply Control Program YISLX: Versions v1.30 and later are fixed versions for CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2023-37555, CVE-2023-37554, CVE-2023-37553, CVE-2023-37552, CVE-2023-37550, CVE-2023-37549, CVE-2023-37548, CVE-2023-37547, CVE-2023-37546, CVE-2023-37545, CVE-2022-4046.
  • ACS880 IGBT Supply Control Program YLHLX: Versions v1.30 and later are fixed versions for CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556, CVE-2023-37555, CVE-2023-37554, CVE-2023-37553, CVE-2023-37552, CVE-2023-37550, CVE-2023-37549, CVE-2023-37548, CVE-2023-37547, CVE-2023-37546, CVE-2023-37545, CVE-2022-4046.

For more information, see ABB's .

ABB strongly recommends the following (non-exhaustive) list of general cyber security practices for any installation of software-related products:

  • Isolate special-purpose networks (e.g., for automation systems) and remote devices behind firewalls, and separate them from any general-purpose network (e.g., office or home networks).
  • Install physical controls so only authorized personnel can access your devices, components, peripheral equipment, and networks.
  • Never connect programming software tools or computers containing programming software to any network other than the network where run the devices that it is intended for.
  • Scan all data imported into your environment before use to detect potential malware infections.
  • Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires it.
  • Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • April 3, 2025: Initial Republication of ABB 9AKK108470A9491
CISA

CISA.gov
1 month ago

1. EXECUTIVE SUMMARY
  • CVSS v3 8.8
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: ABB
  • Equipment: DCT880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3), DCT880 memory unit incl. Power Optimizer, DCS880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3), DCS880 memory unit incl. DEMag, DCS880 memory unit incl. DCC
  • Vulnerabilities: Improper Input Validation, Out-of-bounds Write, Improper Restriction of Operations within the Bounds of a Memory Buffer
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow attackers to trigger a denial-of-service condition or execute arbitrary code over the fieldbus interfaces.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

ABB reports that the following low-voltage DC drive and power controller products contain a vulnerable version of the CODESYS Runtime:

  • DCT880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3): All versions
  • DCT880 memory unit incl. Power Optimizer: All versions
  • DCS880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3): All versions
  • DCS880 memory unit incl. DEMag: All versions
  • DCS880 memory unit incl. DCC: All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

After successful authentication as a user in multiple versions of multiple CODESYS products, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.2

After successful authentication as a user in multiple versions of multiple CODESYS products, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.3

After successful authentication as a user in multiple versions of multiple CODESYS products, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer which can lead to a denial-of-service condition

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.4

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.5

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.6

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.7

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.8

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.9

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.10

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.11

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.12

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.13

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.14

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

3.2.15

In multiple versions of CODESYS Control an improper restriction of operations within the bounds of a memory buffer allow a remote attacker with user privileges to gain full access of the device.

has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Switzerland
3.4 RESEARCHER

ABB PSIRT reported these vulnerabilities to CISA.

4. MITIGATIONS

If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the workarounds section of the ABB .

For more information, see ABB's .

ABB strongly recommends the following (non-exhaustive) list of general cyber security practices for any installation of software-related products:

  • Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
  • Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
  • Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
  • Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Also, understand that VPNs are only as secure as the connected devices.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • April 3, 2025: Initial Republication of ABB 9AKK108470A9494
CISA

CISA.gov
1 month ago

1. EXECUTIVE SUMMARY
  • CVSS v4 9.2
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: B&R
  • Equipment: APROL
  • Vulnerabilities: Inclusion of Functionality from Untrusted Control Sphere, Incomplete Filtering of Special Elements, Improper Control of Generation of Code ('Code Injection'), Improper Handling of Insufficient Permissions or Privileges , Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function, Exposure of Sensitive System Information to an Unauthorized Control Sphere, Exposure of Data Element to Wrong Session, Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), External Control of File Name or Path, Incorrect Permission Assignment for Critical Resource
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to execute commands, elevate privileges, gather sensitive information, or alter the product.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

B&R reports that the following products are affected:

  • B&R APROL: All versions prior to 4.4-01 (CVE-2024-45483, CVE-2024-10209)
  • B&R APROL: All versions 4.4-00P1 and prior (CVE-2024-45482)
  • B&R APROL: All versions 4.4-00P5 and prior (CVE-2024-45481, CVE-2024-45480, CVE-2024-8315, CVE-2024-45484, CVE-2024-8313, CVE-2024-8314, CVE-2024-10206, CVE-2024-10207, CVE-2024-10208, CVE-2024-10210)
3.2 VULNERABILITY OVERVIEW 3.2.1

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.5 has been calculated; the CVSS vector string is ().

3.2.2

An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.5 has been calculated; the CVSS vector string is ().

3.2.3

An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system.

has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.2 has been calculated; the CVSS vector string is ().

3.2.4

An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information.

has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 6.8 has been calculated; the CVSS vector string is ().

3.2.5

An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to perform Denial-of-Service (DoS) attacks against the product.

has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.2 has been calculated; the CVSS vector string is ().

3.2.6

A Missing Authentication for Critical Function vulnerability in the GRUB configuration used in B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system.

has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.0 has been calculated; the CVSS vector string is ().

3.2.7

An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP.

has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.7 has been calculated; the CVSS vector string is ().

3.2.8

An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Session vulnerability in the session handling used in B&R APROL <4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials.

has been assigned to this vulnerability. A CVSS v3 base score of 8.0 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 5.5 has been calculated; the CVSS vector string is ().

3.2.9

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs.

has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 6.9 has been calculated; the CVSS vector string is ().

3.2.10

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs

has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 5.3 has been calculated; the CVSS vector string is ().

3.2.11

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user's browser session.

has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 5.1 has been calculated; the CVSS vector string is ().

3.2.12

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to access data from the file system.

has been assigned to this vulnerability. A CVSS v3 base score of 8.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.4 has been calculated; the CVSS vector string is ().

3.2.13

An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.5 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Austria
3.4 RESEARCHER

ABB PSIRT reported these vulnerabilities to CISA.

4. MITIGATIONS

B&R has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • B&R APROL 4.4-01: B&R recommends that users apply the patch or upgrade to a non-vulnerable version at their earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual. As some of the vulnerabilities affect the confidentiality of credentials, it is recommended to change all secrets/passwords after applying the update. (CVE-2024-45483, CVE-2024-10209)
  • B&R APROL 4.4-00P1: B&R recommends that users apply the patch or upgrade to a non-vulnerable version at their earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual. As some of the vulnerabilities affect the confidentiality of credentials, it is recommended to change all secrets/passwords after applying the update. (CVE-2024-45482)
  • B&R APROL 4.4-00P5: B&R recommends that users apply the patch or upgrade to a non-vulnerable version at their earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual. As some of the vulnerabilities affect the confidentiality of credentials, it is recommended to change all secrets/passwords after applying the update. (CVE-2024-45481, CVE-2024-45480, CVE-2024-8315, CVE-2024-45484, CVE-2024-8313, CVE-2024-8314, CVE-2024-10206, CVE-2024-10207, CVE-2024-10208, CVE-2024-10210)

The following product versions have been fixed:

  • B&R APROL 4.4-01: APROL version 4.4-01 is a fixed version for CVE-2024-45483 and CVE-2024-10209
  • B&R APROL 4.4-00P1: APROL versions 4.4-00P1 and later are fixed versions for CVE-2024-45482
  • B&R APROL 4.4-00P5: APROL versions 4.4-00P5 and later are fixed versions for CVE-2024-45481, CVE-2024-45480, CVE-2024-8315, CVE-2024-45484, CVE-2024-8313, CVE-2024-8314, CVE-2024-10206, CVE-2024-10207, CVE-2024-10208, and CVE-2024-10210

For more information, see B&R's .

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • April 3, 2025: Initial publication of B&R SA24P015
CISA

CISA.gov
1 month 1 week ago

1. EXECUTIVE SUMMARY
  • CVSS v4 9.4
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Rockwell Automation
  • Equipment: Lifecycle Services with Veeam Backup and Replication
  • Vulnerability: Deserialization of Untrusted Data
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker with administrative privileges to execute code on the target system.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Rockwell Automation reports the following Lifecycle Services with Veeam Backup and Replication are affected:

  • Industrial Data Center (IDC) with Veeam: Generations 1 – 5
  • VersaVirtual Appliance (VVA) with Veeam: Series A - C
3.2 VULNERABILITY OVERVIEW 3.2.1

A remote code execution vulnerability exists in Veeam Backup and Replication, which the affected products use. Exploitation of the vulnerability can allow a threat actor to execute code on the target system.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.9 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.4 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER

Rockwell Automation reported this vulnerability to CISA.

4. MITIGATIONS

Users with an active Rockwell Automation Infrastructure Managed Service contract:

  • Rockwell Automation will contact impacted users to discuss actions needed for remediation efforts.

Users without Rockwell Automation managed services contract, refer to Veeam's advisories below:

Additionally, users of the affected software who are not able to upgrade to one of the corrected versions are encouraged to apply where possible.

For more information refer to

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY
  • April 1, 2025: Initial Republication of Rockwell Automation SD1724
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 8.7
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: ABB
  • Equipment: RMC-100
  • Vulnerability: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to send a specially crafted message to the web UI, causing a temporary denial of service until the interface can be restarted.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

ABB reports that the following products are affected when the REST interface is enabled:

  • RMC-100: Versions 2105457-036 to 2105457-044
  • RMC-100 LITE: Versions 2106229-010 to 2106229-016
3.2 VULNERABILITY OVERVIEW 3.2.1

A vulnerability exists in the web UI (REST interface) included in the product versions listed above. An attacker could exploit the vulnerability by sending a specially crafted message to the web UI node, causing a node process hang, requiring restart of the REST interface (disable/enable).

has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.7 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Switzerland
3.4 RESEARCHER

ABB PSIRT reported this vulnerability to CISA.

4. MITIGATIONS

ABB recommends that users apply the following updates at earliest convenience.

  • Update RMC-100 Customer Package to
  • Update RMC-100 LITE Customer Package to

ABB recommends disabling the REST interface when not in use to configure the MQTT functionality. By default, the REST interface is disabled so no risk is present.
The RMC-100 is not intended for access over public networks such as the internet. An attacker would need to have access to the user's private control network to exploit this vulnerability. Proper network segmentation is recommended.

For more information, please see

For any installation of software-related ABB products, ABB strongly recommends the following (non-exhaustive) list of cyber security practices:

  • Isolate special-purpose networks (e.g., for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g., office or home networks).
  • Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
  • Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
  • Scan all data imported into your environment before use to detect potential malware infections.
  • Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
  • Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 25, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 8.9
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Rockwell Automation
  • Equipment: Verve Asset Manager
  • Vulnerability: Improper Validation of Specified Type of Input
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker with administrative access to run arbitrary commands in the context of the container running the service.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Rockwell Automation reports the following versions of Verve Asset Manager are affected:

  • Verve Asset Manager: Versions 1.39 and prior
3.2 VULNERABILITY OVERVIEW 3.2.1

A vulnerability exists in the affected product due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Active Directory Interface (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.1 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.9 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER

Rockwell Automation reported this vulnerability to CISA.

4. MITIGATIONS

Rockwell Automation has corrected the issue in software Version 1.40. Users of the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible.   

For more information refer to

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 25, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 7.3
  • ATTENTION: High attack complexity
  • Vendor: Rockwell Automation
  • Equipment: 440G TLS-Z
  • Vulnerability: Improper Neutralization of Special Elements in Output Used by a Downstream Component
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to take over the device.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Rockwell Automation reports the following products are affected by a vulnerability because they use STMicroelectronics STM32L4 devices:

  • 440G TLS-Z: Version v6.001
3.2 VULNERABILITY OVERVIEW 3.2.1

A local code execution vulnerability exists in the STMicroelectronics STM32L4 devices due to having incorrect access controls. The affected product utilizes the STMicroelectronics STM32L4 device and because of the vulnerability, a threat actor could reverse protections that control access to the JTAG interface. If exploited, a threat actor can take over the device.

has been assigned to this vulnerability. A CVSS v3.1 base score of 7.0 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER

Rockwell Automation reported this vulnerability to CISA.

4. MITIGATIONS

Rockwell Automation encourages users of the affected software to apply the risk mitigations if possible:

  • Limit physical access to authorized personnel: Control room, cells/areas, control panels, and devices.
  • For information on how to mitigate security risks on industrial automation control systems, Rockwell Automation encourage users to implement to minimize the risk of the vulnerability.

For more information refer to

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.

5. UPDATE HISTORY
  • March 25, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 9.3
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Inaba Denki Sangyo Co., Ltd.
  • Equipment: CHOCO TEI WATCHER mini
  • Vulnerabilities: Use of Client-Side Authentication, Storing Passwords in a Recoverable Format, Weak Password Requirements, Direct Request ('Forced Browsing')
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to obtain the product's login password, gain unauthorized access, tamper with product's data, and/or modify product settings.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

The following versions of CHOCO TEI WATCHER are affected:

  • CHOCO TEI WATCHER mini (IB-MCT001): All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

The affected product is vulnerable to a use of client-side authentication vulnerability, which may allow an attacker to obtain the product's login password without authentication.

has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.7 has been calculated; the CVSS vector string is ().

3.2.2

An attacker who can access the microSD card used on the product may obtain the product's login password.

has been assigned to this vulnerability. A CVSS v3.1 base score of 4.6 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 5.1 has been calculated; the CVSS vector string is ().

3.2.3

The affected product is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.3 has been calculated; the CVSS vector string is ().

3.2.4

If a remote attacker sends a specially crafted HTTP request to the product, the product's data may be obtained or deleted, and/or the product's settings may be altered.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.3 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Japan
3.4 RESEARCHER

Andrea Palanca of Nozomi Networks reported these vulnerabilities to Inaba Denki Sangyo Co., Ltd. and CISA.

JPCERT/CC coordinated with Andrea Palanca, CISA ICS, and Inaba Denki Sangyo Co., Ltd.

4. MITIGATIONS

Inaba Denki Sangyo Co., Ltd. recommends users follow the following workarounds to help mitigate the impacts of these vulnerabilities:

  • Use the product within LAN and block access from untrusted networks and hosts through firewalls.
  • Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required, and restrict Internet access to minimum.
  • Restrict the product operation (including use/handling of microSD cards on the product) only to authorized users.

For more information see the associated security advisory and .

CISA recommends users take defensive measures to minimize the risk of exploitation.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 25, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 8.5
  • ATTENTION: Low attack complexity
  • Vendor: Schneider Electric
  • Equipment: EcoStruxureâ„¢
  • Vulnerability: Improper Privilege Management
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to cause a local privilege escalation, which could result in loss of confidentiality, integrity and availability of the engineering workstation.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

The following versions of EcoStruxureâ„¢ are affected:

  • EcoStruxureâ„¢ Process Expert: Versions 2020R2, 2021 & 2023 (prior to v4.8.0.5715)
  • EcoStruxureâ„¢ Process Expert for AVEVA System Platform: Versions 2020R2, 2021 & 2023
3.2 VULNERABILITY OVERVIEW 3.2.1

An improper privilege management vulnerability exists for two services, one managing audit trail data and the other acting as server managing client request, that could cause a loss of confidentiality, integrity, and availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.

has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.5 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Charit Misra, DNV Cyber reported this vulnerability to Schneider Electric.

4. MITIGATIONS

Schneider Electric has identified the following specific remediations and mitigations users can apply to reduce risk:

  • Version v4.8.0.5715 of EcoStruxureâ„¢ Process Expert 2023 Software Package includes a fix for this vulnerability and is available for
  • Uninstall Version 2023 (v4.8.0.5115) before installing Version 2023 (v4.8.0.5715). Version string can be found on engineering server console.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's for assistance removing a patch.

If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

  • EcoStruxureâ„¢ Process Expert Versions 2020R2, 2021 & 2023 (prior to v4.8.0.5715): Allow execute permission for service control Windows utility only to admin user. McAfee Application and Change Control software for application control to allow execution of whitelisted applications only. Refer to the
  • EcoStruxureâ„¢ Process Expert for AVEVA System Platform Versions 2020R2, 2021 & 2023: Schneider Electric is establishing a remediation plan for all future versions of EcoStruxureâ„¢ Process Expert for AVEVA System Platform that will include a fix for this vulnerability. Schneider Electric will update SEVD-2025-042-03 when the remediation is available. Until then, users should immediately apply the following mitigations to reduce the risk of exploit: Allow only admin users to configure windows service by restricting execute permission of sc.exe windows utility. McAfee Application and Change Control software for application control to allow execution of whitelisted applications only. Refer to the

Schneider Electric strongly recommend the following industry cybersecurity best practices.

  • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
  • Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
  • Place all controllers in locked cabinets and never leave them in the "Program" mode.
  • Never connect programming software to any network other than the network intended for that device.
  • Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
  • Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
  • Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric document.

For more information, see Schneider Electric security notification .

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY
  • March 20, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 7.1
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Schneider Electric
  • Equipment: Enerlin'X IFE interface and Enerlin'X eIFE
  • Vulnerabilities: Improper Input Validation
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition which would require the device to need to be manually rebooted.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

The following versions of Enerlin'X IFE interface and Enerlin'X eIFE are affected:

  • Enerlin'X IFE interface: All versions
  • Enerlin'X eIFE: All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

An improper input validation vulnerability exists that could cause a denial of service of the product when malicious IPV6 packets are sent to the device.

has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.1 has been calculated; the CVSS vector string is ().

3.2.2

An improper input validation vulnerability exists that could cause denial of service of the product when malicious ICMPV6 packets are sent to the device.

has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.1 has been calculated; the CVSS vector string is ().

3.2.3

An improper input validation vulnerability exists that could cause denial of service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker remains intact during the attack.

has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 6.9 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Schneider Electric reported these vulnerabilities to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific remediations and mitigations users can apply to reduce risk:

  • CVE-2025-0814: Version 004.010.000 of Enerlin'X IFE and eIFE includes a fix for this vulnerability. to install the latest firmware version of the Enerlin'X IFE and eIFE.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric strongly recommends the use of back-ups and evaluating the impact of these patches in a test and development environment or on an offline infrastructure. Contact Schneider Electric's for assistance removing a patch.

If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

Enerlin'X IFE and eIFE: All versions (CVE-2025-0815 and CVE-2025-0816).

Users should immediately apply the following mitigations to reduce the risk of exploit:

  • Use devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public Internet or untrusted networks.
  • Setup network segmentation and implement a firewall to block all unauthorized access to ports supported by the product and listed in the
  • Configure the Access Control List following the recommendations of the and the
  • To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to

Schneider Electric strongly recommends the following industry cybersecurity best practices:

  • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
  • Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
  • Place all controllers in locked cabinets and never leave them in the "Program" mode.
  • Never connect programming software to any network other than the network intended for that device.
  • Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
  • Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
  • Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric document.

For more information about these vulnerabilities, see Schneider Electric security notification .

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 20, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see 

1. EXECUTIVE SUMMARY
  • CVSS v4 7.3
  • ATTENTION: Low Attack Complexity
  • Vendor: Siemens
  • Equipment: Simcenter Femap
  • Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute code within the current process of the product.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • Simcenter Femap V2401: Versions prior to V2401.0003
  • Simcenter Femap V2406: Versions prior to V2406.0002
3.2 VULNERABILITY OVERVIEW 3.2.1

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER

Trend Micro Zero Day Initiative reported this vulnerability to Siemens.

4. MITIGATIONS

Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • Simcenter Femap V2401:
  • Simcenter Femap V2406:

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • All affected products: Do not open untrusted NEU files in affected application

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the

For more information see the associated Siemens security advisory SSA-920092 in and .

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY
  • March 20, 2025: Initial Publication
CISA

CISA.gov
1 month 2 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 6.9
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: SMA
  • Equipment: Sunny Portal
  • Vulnerability: Unrestricted Upload of File with Dangerous Type
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

The following versions of SMA Sunny Portal are affected:

  • Sunny Portal: All versions before December 19, 2024
3.2 VULERABILITY OVERVIEW 3.2.1

The SMA Sunny Portal is vulnerable to an unauthenticated remote attacker who can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.

has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 6.9 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER

Francesco La Spina from Forescout Technologies Inc. first reported this vulnerability to CERT@VDE. Daniel dos Santos from Forescout Technologies Inc. then reported this vulnerability to CISA.

4. MITIGATIONS

No further action is required. The vulnerability was closed in the portal on December 19, 2024.

Please contact the for more information.

CERT@VDE published advisory number on this issue.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 20, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 9.2
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Schneider Electric
  • Equipment: WebHMI – Deployed with EcoStruxure Power Automation System
  • Vulnerability: Initialization of a Resource with an Insecure Default
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow unauthorized access to the underlying software application running WebHMI.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected because they use WebHMI v4.1.0.0 and prior:

  • EcoStruxure Power Automation System: Versions 2.6.30.19 and prior
3.2 VULNERABILITY OVERVIEW 3.2.1

An initialization of a resource with an insecure default vulnerability exists that could cause an attacker to execute unauthorized commands when a system's default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.2 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Cumhur Kizilari of Proofpoint reported this vulnerability to Schneider Electric.

4. MITIGATIONS

Hotfix WebHMI_Fix_users_for_Standard.V1 of WebHMI includes a fix for this vulnerability and can be obtained from the

Users should employ appropriate patching methodologies when applying these patches to their systems. Schneider Electric strongly recommends the use of back-ups and evaluating the impact of these patches in a test and development environment or on an offline infrastructure. if you need assistance removing a patch.

Once the hotfix, WebHMI_Fix_users_for_Standard.V1, has been applied, Schneider Electric recommends ensuring that all hardening guidelines provided with the product are implemented to maintain best practices for defense-in-depth. Specifically, the WebHMI should not be exposed to the Internet. for assistance if required.

Schneider Electric strongly recommends the following industry cybersecurity best practices:

  • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
  • Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
  • Place all controllers in locked cabinets and never leave them in the "Program" mode.
  • Never connect programming software to any network other than the network intended for that device.
  • Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
  • Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
  • Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  • For more information refer to the document.

Please see Schneider Electric Security Notification for more information on this issue.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 18, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 4.0
  • ATTENTION: Low attack complexity
  • Vendor: Schneider Electric
  • Equipment: EcoStruxure Panel Server
  • Vulnerability: Insertion of Sensitive Information into Log File
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow disclosure of sensitive information, including the disclosure of credentials.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Schneider Electric reports the following versions of EcoStruxure Panel Server are affected:

  • EcoStruxure Panel Server: Versions v2.0 and prior
3.2 VULNERABILITY OVERVIEW 3.2.1

There is an insertion of sensitive information into log files vulnerability that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.

has been assigned to this vulnerability. A CVSS v3.1 base score of 6.0 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 4.0 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Schneider Electric reported this vulnerability to CISA.

4. MITIGATIONS

Version 2.1 or later of EcoStruxure Panel Server includes a fix for this vulnerability and is available for Users should download EcoStruxure Power Commission Software v2.33.0 or later, and version v2.1 or later of EcoStruxure Panel Server firmware to complete the upgrade process.

Users should employ appropriate patching methodologies when applying these patches to their systems. Schneider Electric strongly recommends the use of back-ups and evaluating the impact of these patches in a test and development environment or on an offline infrastructure. for assistance removing a patch.

If users choose not to apply the remediation provided above, they should immediately ensure that debug mode is off will prevent the credentials from being improperly exposed.

Schneider Electric strongly recommends the following industry cybersecurity best practices.

  • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
  • Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
  • Place all controllers in locked cabinets and never leave them in the "Program" mode.
  • Never connect programming software to any network other than the network intended for that device.
  • Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
  • Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
  • Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  • For more information refer to the

Please see Schneider Electric Security Notification for more information about this issue.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY
  • March 18, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 9.4
  • ATTENTION: Low attack complexity/public exploits are available/known public exploitation
  • Vendor: Rockwell Automation
  • Equipment: Industrial Data Center (IDC) with VMware, VersaVirtual Appliance (VVA) with VMware, Threat Detection Managed Services (TDMS) with VMware, Endpoint Protection Service with RA Proxy & VMware, Engineered and Integrated Solutions with VMware
  • Vulnerabilities: Time-of-check Time-of-use (TOCTOU) Race Condition, Write-what-where Condition, Out-of-bounds Read
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker with local administrative privileges to execute code.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

The following versions of Rockwell Automation Lifecycle Services with VMware are affected:

  • Industrial Data Center (IDC) with VMware: Generations 1 through 4
  • VersaVirtual Appliance (VVA) with VMware: Series A and B
  • Threat Detection Managed Services (TDMS) with VMware: All versions
  • Endpoint Protection Service with RA Proxy & VMware only: All versions
  • Engineered and Integrated Solutions with VMware: All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

A time of check time of use (TOCTOU) vulnerability exists in VMware ESXi, which the affected products use. Exploitation of the vulnerability can allow a threat actor with local administrative privileges to execute code as the virtual machine's VMX process running on the host.

has been assigned to this vulnerability. A CVSS v3.1 base score of 9.3 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.4 has been calculated; the CVSS vector string is ().

3.2.2

A code execution vulnerability exists in VMware ESXi, which the affected products use. Exploitation of the vulnerability can allow a threat actor with privileges within the VMX process trigger an arbitrary kernel write, leading to an escape of the sandbox.

has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 9.3 has been calculated; the CVSS vector string is ().

3.2.3

An out-of-bounds vulnerability exists in VMware ESXi, which the affected products use. Exploitation of the vulnerability can allow a threat actor with administrative privileges to leak memory from the vmx process.

has been assigned to this vulnerability. A CVSS v3.1 base score of 7.1 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.2 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER

Rockwell Automation reported these vulnerabilities to CISA.

4. MITIGATIONS

Rockwell Automation will contact impacted users to discuss actions needed for remediation efforts.

Users without Rockwell Automation managed services contract, refer to Broadcom's advisories below:

Additionally, those using the affected software who are unable to upgrade to one of the corrected versions are encouraged to apply security best practices, where possible.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY
  • March 18, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 7.0
  • ATTENTION: Low Attack Complexity
  • Vendor: Schneider Electric
  • Equipment: EcoStruxure Power Automation System User Interface (EPAS-UI)
  • Vulnerability: Improper Authentication
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to bypass device authentication, potentially gain access to sensitive information, or execute arbitrary code.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Schneider Electric reports that the following products are affected:

  • EcoStruxure Power Automation System User Interface (EPAS-UI): Version v2.1 up to and including v2.9
3.2 VULNERABILITY OVERVIEW 3.2.1

The Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) is vulnerable to authentication bypass. This occurs when an unauthorized user, without permission rights, has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.

has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.0 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Marc Cuny and David Url of GAI NetConsult GmbH reported this vulnerability to Schneider Electric.

4. MITIGATIONS

Schneider Electric has identified the following specific remediations and workarounds users can apply to reduce risk:

  • Version 2.10 of Estrutura Power Automation System User Interface(EPAS-UI) includes a fix for this vulnerability and is available by contacting
  • If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Please strictly follow all the instructions below: Step 1: Login with Admin privileges Step 2: Go to the folder C:\MCIS\Bin Step 3: Rename the file ‘MCIS.chm' to ‘MCIS.old' Note: to see file extensions, activate the visualization of file name extensions in Windows Explorer ‘View' options. Step 4: Restart the machine.

For more information see the associated Schneider Electric CPCERT security advisory , .

Schneider Electric strongly recommends the following industry cybersecurity best practices:

  • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
  • Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
  • Place all controllers in locked cabinets and never leave them in the "Program" mode.
  • Never connect programming software to any network other than the network intended for that device.
  • Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
  • Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
  • Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  • For more information refer to the

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY
  • March 18, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

1. EXECUTIVE SUMMARY
  • CVSS v4 8.7
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Schneider Electric
  • Equipment: ASCO 5310 / 5350
  • Vulnerabilities: Download of Code Without Integrity Check, Allocation of Resources Without Limits or Throttling, Cleartext Transmission of Sensitive Information, Unrestricted Upload of File with Dangerous Type
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to perform a denial of service, loss of availability, or loss of device integrity.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected:

  • Schneider Electric ASCO 5310 Single-Channel Remote Annunciator: All versions
  • Schneider Electric ASCO 5350 Eight Channel Remote Annunciator: All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

Schneider Electric ASCO 5310 / 5350 remote annunciator is vulnerable to a download of code without integrity check vulnerability that could render the device inoperable when malicious firmware is downloaded.

has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.2 has been calculated; the CVSS vector string is ().

3.2.2

Schneider Electric ASCO 5310 / 5350 remote annunciator is vulnerable to an allocation of resources without limits or throttling vulnerability that could cause communications to stop when malicious packets are sent to the webserver of the device.

has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.7 has been calculated; the CVSS vector string is ().

3.2.3

Schneider Electric ASCO 5310 / 5350 remote annunciator is vulnerable to a cleartext transmission of sensitive information vulnerability that could result in the exposure of data when network traffic is being sniffed by an attacker.

has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 8.7 has been calculated; the CVSS vector string is ().

3.2.4

Schneider Electric ASCO 5310 / 5350 remote annunciator is vulnerable to an unrestricted upload of file with dangerous type vulnerability that could render the device inoperable when a malicious file is downloaded.

has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.2 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: France
3.4 RESEARCHER

Schneider Electric reported these vulnerabilities to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Schneider Electric is establishing a remediation plan for all future versions of ASCO 5310 Single-Channel Remote Annunciator and ASCO 5350 Eight Channel Remote Annunciator, which may include a fix for these vulnerabilities. Schneider Electric will provide an update when the remediation is available. Until then, users should immediately apply the following mitigations to reduce the risk of exploit:

  • Use remote annunciator devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public Internet or untrusted networks.
  • Change default password to help prevent unauthorized access to device settings and information.
  • Setup network segmentation and implement a firewall to block all unauthorized access to the annunciator Port 80/HTTP.
  • For more details on the ASCO 5310 refer to "Installation Manual | ASCO 5310 ATS Remote Annunciator," which can be found here:
  • For more details on the ASCO 5350 refer to "Installation Manual | ASCO 5350 ATS Remote Annunciator," which can be found here:
  • To ensure users are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here:

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-042-01 , .

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 18, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see 

1. EXECUTIVE SUMMARY
  • CVSS v4 7.3
  • ATTENTION: Low attack complexity
  • Vendor: Siemens
  • Equipment: Teamcenter Visualization and Tecnomatrix Plant Simulation
  • Vulnerabilities: Out-of-bounds Write, Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Read, Use After Free
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could cause the application to crash or potentially lead to arbitrary code execution.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Siemens reports the following products are affected:

  • Teamcenter Visualization V14.3: Versions prior to V14.3.0.13
  • Teamcenter Visualization V2312: Versions prior to V2312.0009
  • Teamcenter Visualization V2406: Versions prior to V2406.0007
  • Teamcenter Visualization V2412: Versions prior to V2412.0002
  • Tecnomatix Plant Simulation V2302: Versions prior to V2302.0021
  • Tecnomatix Plant Simulation V2404: Versions prior to V2404.0010
3.2 VULNERABILITY OVERVIEW 3.2.1

The affected applications contain an out-of-bounds write vulnerability when parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.2

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.3

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.4

The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.5

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.6

The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.7

The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.2.8

The affected applications contain an out-of-bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.3 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER

Jin Huang from ADLab of Venustech and Michael Heinzl reported these vulnerabilities to Siemens.

4. MITIGATIONS

Siemens has released new versions for the affected products and recommends to update to the latest versions:

  • Teamcenter Visualization V14.3:
  • Teamcenter Visualization V2312:
  • Teamcenter Visualization V2406:
  • Teamcenter Visualization V2412:
  • Tecnomatix Plant Simulation V2302:
  • Tecnomatix Plant Simulation V2404:

To reduce risk, Siemens recommends that users not open untrusted WRL files in affected applications.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the

For more information see the associated Siemens security advisory SSA-050438 in and .

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY
  • March 13, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see 

1. EXECUTIVE SUMMARY
  • CVSS v4 7.1
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: SINEMA Remote Connect Server
  • Vulnerabilities: Improper Output Neutralization for Logs, Missing Release of Resource after Effective Lifetime
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to send garbage to OpenVPN log, cause high CPU load, or extend the validity of a closing session.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Siemens reports the following products are affected:

  • SINEMA Remote Connect Server: Versions prior to V3.2 SP3
3.2 VULNERABILITY OVERVIEW 3.2.1

A malicious openvpn peer can send garbage to OpenVPN log or cause high CPU load.

has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 5.3 has been calculated; the CVSS vector string is ().

3.2.2

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session.

has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ().

A CVSS v4 score has also been calculated for . A base score of 7.1 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy, Food and Agriculture, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has released a new version for SINEMA Remote Connect Server and recommends updating to .

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the

For more information see the associated Siemens security advisory SSA-073066 in and .

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY
  • March 13, 2025: Initial Publication
CISA

CISA.gov
1 month 3 weeks ago

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see 

1. EXECUTIVE SUMMARY
  • CVSS v3 7.8
  • ATTENTION: Low attack complexity
  • Vendor: Siemens
  • Equipment: SIMATIC S7-1500 TM MFP
  • Vulnerabilities: Double Free, Use After Free, NULL Pointer Dereference, Buffer Access with Incorrect Length Value, Use of Uninitialized Variable
2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause a denial-of-service condition, or gain unauthorized access to sensitive information.

3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • SIMATIC S7-1500 TM MFP - BIOS: All versions
3.2 VULNERABILITY OVERVIEW 3.2.1

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach. The number of the currently released descriptor is never incremented, which results in the same skb being released multiple times.

has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is ().

3.2.2

In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

3.2.3

In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it.

has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is ().

3.2.4

In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated).

has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is ().

3.2.5

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD.

has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ().

3.3 BACKGROUND
  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • Only build and run applications from trusted sources
  • Currently no fix is available

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the

For more information see the associated Siemens security advisory SSA-503939 in and .

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are .
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for on the ICS webpage on . Several CISA products detailing cyber defense best practices are available for reading and download, including .

CISA encourages organizations to implement recommended cybersecurity strategies for .

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at in the technical information paper, .

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

  • Do not click web links or open attachments in unsolicited email messages.
  • Refer to for more information on avoiding email scams.
  • Refer to for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY
  • March 13, 2025: Initial Publication
CISA