Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Rockwell Automation 2025 ICS Vulnerabilities: Studio 5000 Path Traversal & SSRF Risks
In November 2025, Rockwell Automation disclosed critical vulnerabilities affecting its Studio 5000 Simulation Interface used across chemical and manufacturing sectors. The issues—Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-11696) and Server-Side Request Forgery (CVE-2025-11697)—allowed local attackers to execute arbitrary scripts with administrator privileges and capture NTLM hashes via outbound SMB requests. The vulnerabilities impacted versions 2.02 and earlier, and, if exploited, could grant attackers lateral movement or privileged control within industrial environments, threatening operational integrity and sensitive data. These vulnerabilities highlight ongoing threats to industrial control systems (ICS) and the continued focus of adversaries on exploiting misconfigurations and overlooked APIs. With increasing regulatory pressure for critical infrastructure resilience and the evolution of ICS-specific ransomware and supply chain attacks, such vulnerabilities remain a potent risk requiring constant attention and timely remediation.
CISA Flags 18 Critical ICS Vulnerabilities Across Major Vendors
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released 18 advisories highlighting critical vulnerabilities across a wide spectrum of Industrial Control Systems (ICS) products from vendors such as Mitsubishi Electric, AVEVA, Rockwell Automation, Siemens, and others. These advisories detailed security gaps including unencrypted communications, insufficient segmentation, lack of policy enforcement, and exploitable firmware flaws. Although no specific exploitation campaigns were publicly confirmed at the time, the breadth and technical depth of the advisories underscore the ICS sector’s wide attack surface and the urgent need for robust controls and timely patching to prevent downtime, data loss, or operational safety issues. This disclosure is especially relevant given the escalating sophistication of threat actors targeting operational technology and the convergence of IT/OT networks. The incident reflects a steady increase in supply chain exposures and nation-state attention on industrial sectors, amplifying risk to critical infrastructure worldwide.
Critical Authorization Flaw Exposes Rockwell Automation Verve Asset Manager (2025)
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2025-11862) in multiple versions of its Verve Asset Manager platform, widely used in industrial control system cybersecurity. The flaw, present from versions 1.33 up to 1.41.3, arises from an incorrect authorization configuration that allows unauthorized read-only users to perform privileged API operations, such as reading, updating, and deleting user accounts. The vulnerability, which is remotely exploitable with low attack complexity, exposes critical manufacturing environments to potential data breaches or sabotage until properly patched. Rockwell addressed the issue in version 1.41.4 and subsequent releases, urging all customers to update immediately. This incident underscores the growing risk baseline facing operational technology (OT) and ICS environments as attackers increasingly target authorization misconfigurations and API exposures. Regulatory pressure and rising sophistication in adversary tactics make strong access controls and rapid patch management more essential than ever for organizations managing critical infrastructure.
2025 Rockwell FactoryTalk Policy Manager DoS Vulnerability Exposes Critical Manufacturing
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2024-22019) affecting versions 6.51.00 and earlier of its FactoryTalk Policy Manager, a tool widely deployed in industrial and manufacturing environments for policy enforcement and network segmentation. The flaw—tied to improper resource shutdown or release in the Node.js HTTP server—enables remote attackers to send specially crafted chunked HTTP requests that exhaust CPU and network resources, resulting in denial-of-service (DoS) conditions. While no active exploitation was reported as of publication, the vulnerability posed operational risks to OT systems globally, especially in critical manufacturing sectors. The incident underscores the risks posed by third-party software dependencies in industrial control system environments, especially as attackers target resource exhaustion vectors that bypass conventional safeguards. The disclosure highlights the increasing urgency for proactive vulnerability management and defense-in-depth strategies, given the essential role of OT in critical infrastructure.
Brightpick ICS Flaws Expose Critical Automation Functions and Credentials Globally
In November 2025, vulnerabilities were discovered in Brightpick AI's Mission Control and Internal Logic Control, software used for warehouse automation globally. Security researcher Souvik Kandar disclosed that all product versions lacked authentication for critical functions and exposed sensitive credentials via unencrypted channels, including WebSocket traffic accessible without prior authentication. If exploited, attackers could manipulate robot controls or intercept sensitive information, posing operational and confidentiality risks to organizations in sectors such as manufacturing, healthcare, and logistics. Brightpick AI had not issued a response or patch at the time of the initial disclosure. This incident stands out due to its impact on operational technology and industrial control systems, highlighting the widespread risk of exposed critical functions and hardcoded credentials in automation platforms. With growing connectivity in ICS environments, such vulnerabilities reflect an urgent need for organizations to bolster segmentation, credential management, and network security controls.
2025 Siemens Spectrum Power 4 Flaws: Privilege Escalation in Critical ICS
In November 2025, Siemens disclosed a set of severe vulnerabilities impacting its Spectrum Power 4 platform, a widely deployed solution in the global energy sector. Discovered by researchers at Limes Security and reported through Siemens ProductCERT, these issues include incorrect use of privileged APIs, flawed privilege assignment, and insecure permissions, collectively enabling remote and local attackers to execute arbitrary code with administrative privileges or extract sensitive credentials. While there are currently no reports of active exploitation, the vulnerabilities expose critical infrastructure operators to the risk of operational disruption and data compromise. This incident highlights persistent threats due to weak privilege controls and insecure configurations in industrial control systems (ICS), which are increasingly targeted by sophisticated actors. With the energy sector classified as critical infrastructure, such exposures have regulatory, safety, and reputational consequences, driving renewed urgency for timely patch management and robust network segmentation.
Mitsubishi Electric 2025: Denial-of-Service Vulnerability Impacts Industrial Control Systems
In November 2025, a denial-of-service (DoS) vulnerability (CVE-2025-10259) impacting Mitsubishi Electric MELSEC iQ-F Series programmable logic controllers was publicly disclosed. Researchers from Zhongguancun Laboratory and Tsinghua University identified that improper validation in the TCP communication module allowed remote attackers to send specially crafted TCP packets, causing affected devices to disconnect and become temporarily unresponsive. The vulnerability (CVSS 5.3) requires no authentication and can be exploited remotely, posing a notable risk to industrial control systems in the critical manufacturing sector worldwide. This incident highlights persistent cybersecurity weaknesses in industrial IoT and critical infrastructure devices, which attackers increasingly target to disrupt operations. As regulatory expectations and threat actor sophistication rise, even moderate-severity flaws in ICS environments must be prioritized and mitigated decisively.
Rockwell Automation FactoryTalk DataMosaix: 2025 ICS Cloud Vulnerabilities Expose Industrial Risk
In November 2025, Rockwell Automation disclosed two critical vulnerabilities in its FactoryTalk DataMosaix Private Cloud platform, widely used across critical manufacturing sectors. The flaws include a weak authentication mechanism (CVE-2025-11084) that enables attackers to bypass MFA and gain unauthorized access, and a persistent cross-site scripting bug (CVE-2025-11085) that could facilitate account takeover, credential theft, or redirecting users to malicious sites. Rockwell and CISA jointly warned that attackers could exploit these remotely and potentially take control of sensitive ICS data or operations globally, demanding urgent updates. These vulnerabilities underscore rising risks tied to identity-driven attacks and web-based threats targeting industrial control environments. With Ransomware-as-a-Service and supply chain attacks escalating, organizations in critical sectors face mounting pressure to implement multi-layered controls and update legacy authentication practices.
Siemens Solid Edge 2025: Improper Certificate Validation Exposes Critical Manufacturing to MITM Attacks
In November 2025, Siemens disclosed a critical vulnerability in its Solid Edge SE2025 product, identified as CVE-2025-40744. This software flaw, stemming from improper certificate validation in the License Service endpoint, allows unauthenticated remote attackers to perform man-in-the-middle (MITM) attacks by intercepting or manipulating encrypted traffic. The issue, rated 8.7 (CVSS v4), affects all versions of Solid Edge SE2025 prior to V225.0 Update 11, putting global critical manufacturing environments at risk of credential interception and data exposure. This incident reflects increasing attacker focus on exploiting certificate validation weaknesses in supply chain and industrial environments. With industrial control systems often at the core of large enterprises' operations, such vulnerabilities demand swift patching and ongoing vigilance in authentication and encrypted traffic controls.
AVEVA Edge 2025: Cryptographic Weakness Leaves Critical Manufacturing at Risk
In November 2025, AVEVA disclosed a critical vulnerability (CVE-2025-9317) in its Edge HMI/SCADA software (versions 2023 R2 and prior), stemming from the use of a broken or risky cryptographic algorithm. The flaw allows local attackers with read access to Edge project or cache files to reverse engineer both application-native and Active Directory passwords via brute-force techniques. This security gap exposes organizations using AVEVA Edge in the critical manufacturing sector to unauthorized credential recovery, potentially impacting operational technology environments on a global scale. The incident highlights increased scrutiny of industrial control software security, especially against a backdrop of escalating supply chain and OT attacks. Regulatory and compliance pressures are intensifying, and organizations are urged to prioritize cryptographic hygiene, proactive patching, and strict access controls to mitigate insider and lateral threat risks.
Critical Flaws in General Industrial Controls Lynx+ Gateway Threaten Manufacturing Security (2025)
In November 2025, critical vulnerabilities were discovered in General Industrial Controls' Lynx+ Gateway devices deployed worldwide across the critical manufacturing sector. The exposed flaws—included weak password requirements, missing authentication for critical functions, and cleartext transmission of sensitive information—allowed attackers to remotely access devices, obtain sensitive information, and, in some cases, potentially cause denial-of-service conditions. Multiple CVEs (CVE-2025-55034, CVE-2025-58083, CVE-2025-59780, CVE-2025-62765) were assigned, with the highest CVSS v4 base score reaching 9.2. Despite coordinated disclosure efforts, the vendor did not respond, leaving organizations reliant on their own layered defense measures. This incident is highly relevant as it highlights persistent challenges in secure authentication and encrypted traffic within operational technology environments. The surge in attacks exploiting similar unauthenticated remote access and cleartext weaknesses continues to drive regulatory pressure for zero trust and encryption controls within industrial networks.
Siemens Altair Grid Engine 2025: Local Privilege Escalation and OT Vulnerability Risks
In November 2025, Siemens disclosed two local privilege escalation vulnerabilities affecting all versions of Altair Grid Engine prior to V2026.0.0. These flaws, identified as CVE-2025-40760 (Generation of Error Message Containing Sensitive Information) and CVE-2025-40763 (Uncontrolled Search Path Element), could allow attackers with local access to extract password hashes or execute arbitrary code with superuser permissions by manipulating environment variables or error handling processes. Although there has been no evidence of exploitation in the wild, the vulnerabilities required only low attack complexity and affected critical manufacturing environments globally. This incident highlights ongoing risks posed by improper input validation and error handling in operational technology (OT) environments, especially as attackers increasingly target privilege escalation vectors. Regulatory bodies emphasize swift detection, patching, and IT/OT segmentation to reduce attack surface, as local escalation flaws remain a persistent threat vector in critical infrastructure.