✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Electrical/Electronic Manufacturing
Breach intelligence, attack campaigns, and threat reports targeting the Electrical/Electronic Manufacturing sector.
Explore Other Sectors
Electrical/Electronic Manufacturing Threat Reports
Schneider Electric EcoStruxure Rapsody Software Vulnerabilities Threaten Critical Infrastructure in 2026
In January 2026, Schneider Electric disclosed multiple critical software vulnerabilities (CVE-2025-13844, CVE-2025-13845) in its EcoStruxure Power Build Rapsody platform, widely used in the energy, manufacturing, and commercial facilities sectors. The flaws—specifically double free and use after free issues—stem from improper memory management when importing malicious project files, enabling local attackers to potentially execute arbitrary code. Impacted product versions are deployed worldwide. Schneider Electric and independent security researchers reported these vulnerabilities, urging customers to upgrade immediately or apply mitigations to prevent unauthorized system access and memory corruption. This incident highlights the continued threat posed by software supply chain attacks and memory corruption vulnerabilities in critical infrastructure environments. As attackers shift towards exploiting insecure file imports and legacy software flaws, organizations must prioritize secure software lifecycle management and timely patching to counter emerging risks.
6 months ago
Kill Chain
Siemens Edge Device Vulnerability Exposes Critical Manufacturing Operations in 2026
In January 2026, Siemens disclosed a critical authorization bypass vulnerability (CVE-2025-40805) affecting a broad range of its Industrial Edge Devices and operator panels. The flaw allows an unauthenticated remote attacker to circumvent user authentication by exploiting weaknesses in certain API endpoints, enabling impersonation of legitimate users. Exploitation requires knowledge of a valid user identity. Siemens promptly released patches and mitigation recommendations for impacted devices, but multiple models remain without fixes as of the initial disclosure, heightening operational risk in environments relying on these devices. This incident underscores the ongoing threat posed by API weaknesses and identity-driven attacks in critical manufacturing and operational technology sectors. As API-driven automation proliferates in industry, organizations must rapidly address such vulnerabilities in devices that underpin essential infrastructure.
6 months ago
Kill Chain
Critical Authorization Bypass Hits Siemens Industrial Edge in 2026
In January 2026, Siemens disclosed a critical vulnerability (CVE-2025-40805) affecting the Industrial Edge Device Kit line for both arm64 and x86-64 architectures. The flaw, present in numerous firmware versions, allows unauthenticated remote attackers to bypass user authentication on specific API endpoints by exploiting an authorization weakness. An attacker who learns a legitimate user’s identity could leverage this to impersonate that user and gain illicit control or visibility within industrial environments. Siemens promptly released security updates and mitigation guidance for impacted devices, urging organizations to update or restrict network access as a preventive measure. This incident highlights increasing risks to operational technology (OT) and critical infrastructure, as authentication flaws in widely deployed industrial solutions can expose factories and utilities globally. The CVE underscores growing threats facing manufacturing, regulatory pressure for timely patching, and ongoing urgency for zero trust controls in industrial systems.
6 months ago
Kill Chain
Delta PLC Vulnerabilities: How 2024’s Critical Flaws Put Industrial Operations at Risk
In June 2024, security researchers publicly disclosed three critical vulnerabilities in Delta Electronics' industrial PLC (Programmable Logic Controller) products, which are widely used across global manufacturing, energy, and automation sectors. These flaws allow remote attackers to bypass authentication, execute arbitrary code, and disrupt operational processes if exploited. While no in-the-wild attacks have been reported to date, the vulnerabilities could grant adversaries broad control over industrial systems and potentially lead to industrial sabotage or production halts. Delta Electronics has released security patches and advisories to help customers mitigate risks. This disclosure is significant because ICS-targeted attacks have increased in sophistication and frequency, exposing the strategic risks of legacy and industrial devices. Critical infrastructure organizations face urgent pressure to update and segment exposed controllers, reinforcing the necessity for real-time threat detection and Zero Trust policies to thwart emerging OT threats.
6 months ago
Kill Chain
ICS in Crisis: Multi-Vector Malware Campaign Hits Industrial Automation Sector in Q3 2025
In Q3 2025, a coordinated multi-vector malware campaign targeted the global industrial automation sector, exploiting both internet-borne and lateral movement vectors to infiltrate sensitive OT environments. Malicious scripts, phishing pages, and spyware were delivered through malicious emails and compromised websites, with attackers leveraging old vulnerabilities in software such as Microsoft Office Equation Editor (CVE-2017-11882) to gain persistent access. The incident impacted biometrics, engineering, and manufacturing industries, affecting up to 27.4% of ICS computers in certain regions, and enabled the delivery of ransomware, spyware, and self-propagating worms across distributed networks. This incident is notable for its breadth—over 11,000 malware families were detected—and its use of diverse channels, from web to USB to network shares. The surge in initial infection via malicious scripts and documents, especially in East Asia and South America, demonstrates attackers’ evolving tactics and the urgent need for improved segmentation, encrypted network traffic, and anomaly detection across critical OT environments.
6 months ago
Kill Chain
CISA Flags Critical ICS Flaws Threatening National Infrastructure in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released nine advisories covering serious vulnerabilities discovered in multiple industrial control systems (ICS) from vendors including Inductive Automation, Schneider Electric, Siemens, Mitsubishi Electric, Advantech, National Instruments, Rockwell Automation, and Axis Communications. These vulnerabilities potentially allow attackers to gain unauthorized access, move laterally, and disrupt or manipulate key operations in sectors such as energy, manufacturing, and transportation. Many of the issues arise from insecure configurations, insufficient encryption, outdated software components, and lack of segmentation between critical assets. This incident highlights the alarming persistence of security gaps across ICS environments. As operational technology (OT) converges with IT, attackers increasingly exploit these systems to launch ransomware, disrupt supply chains, or conduct cyber-physical sabotage, emphasizing the urgent need for robust controls, patching, and increased network visibility in critical infrastructure.
6 months ago
Kill Chain
Siemens Discloses Physical Access Flaw in 2025 G5DFR Devices
In December 2025, Siemens Energy Services disclosed a critical vulnerability in all G5DFR versions of its Elspec G5 devices, affecting industrial control systems worldwide. Attackers with physical access could reset the Admin password by inserting a USB drive containing a public reset string, effectively bypassing authentication (CVE-2025-59392, CVSS 7.0). While exploitation required direct device access, successful attacks would allow unauthorized changes to critical system configurations, risking operational integrity within the energy sector. Siemens and CISA advised urgent firmware updates and robust network isolation to mitigate the risk. This incident highlights the persistent risk of physical-layer threats in critical infrastructure environments, even as digital attack surfaces expand. The availability of public reset procedures underscores the urgency in securing endpoints and the importance of layered, defense-in-depth strategies, especially given the evolving regulatory landscape and increased scrutiny on energy sector cybersecurity.
6 months ago
Kill Chain
Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk
In November 2025, Festo SE & Co. KG disclosed a supply chain vulnerability affecting its Didactic products due to the integration of vulnerable versions of Siemens TIA Portal (V15–V18). The issue, tracked as CVE-2023-26293, stems from improper input validation, allowing attackers to leverage a path traversal flaw. This could result in the creation or overwriting of arbitrary files if a user is tricked into opening a malicious PC system configuration file, leading to potential arbitrary code execution. The exploit, which requires local access with user interaction, impacts engineering systems used globally across critical sectors, including manufacturing, energy, communications, and commercial facilities. This vulnerability is significant as it illustrates the increasing prevalence of supply chain risks in industrial and critical infrastructure software. With threat actors increasingly exploiting the software supply chain and user-driven entry vectors, maintaining rigorous update and validation processes has become a pressing challenge for organizations worldwide.
6 months ago
Kill Chain
CISA Releases Critical ICS Vulnerability Advisories: 2025 Update for Industrial Systems
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released six Industrial Control Systems (ICS) advisories addressing multiple critical vulnerabilities impacting popular ICS products, including Schneider Electric EcoStruxure and Pro-face BLUE Open Studio, Shelly Pro series, METZ CONNECT EWIO2, and PowerChute Serial Shutdown. These advisories alert asset owners, operators, and administrators about exploitation risks and provide detailed technical information and mitigation steps. The vulnerabilities, if left unaddressed, expose essential operational technology environments to risks such as unauthorized access, manipulation, and potential disruption of critical infrastructure services. This disclosure comes amidst a surge in attacks targeting industrial and OT environments, underscoring increased adversary focus on exploiting ICS vulnerabilities. With regulatory pressures mounting and recent attacks on critical infrastructure making headlines, organizations are urged to address these risks with urgency.
6 months ago
Kill Chain
CISA Flags 18 Critical ICS Vulnerabilities Across Major Vendors
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released 18 advisories highlighting critical vulnerabilities across a wide spectrum of Industrial Control Systems (ICS) products from vendors such as Mitsubishi Electric, AVEVA, Rockwell Automation, Siemens, and others. These advisories detailed security gaps including unencrypted communications, insufficient segmentation, lack of policy enforcement, and exploitable firmware flaws. Although no specific exploitation campaigns were publicly confirmed at the time, the breadth and technical depth of the advisories underscore the ICS sector’s wide attack surface and the urgent need for robust controls and timely patching to prevent downtime, data loss, or operational safety issues. This disclosure is especially relevant given the escalating sophistication of threat actors targeting operational technology and the convergence of IT/OT networks. The incident reflects a steady increase in supply chain exposures and nation-state attention on industrial sectors, amplifying risk to critical infrastructure worldwide.
6 months ago
Kill Chain
Critical ICS Vulnerabilities in Siemens SICAM P850/P855 Devices Impact Energy Sector
In November 2025, Siemens disclosed vulnerabilities affecting their SICAM P850 and P855 industrial control device families. Specifically, these products were susceptible to a Cross-Site Request Forgery (CSRF) flaw and incorrect permission assignment for critical resources, allowing attackers to execute unauthorized actions or impersonate users. The weaknesses impacted devices globally deployed in energy-critical infrastructure, with the main risk being attackers exploiting web sessions to modify device configuration or gain prolonged unauthorized access. Siemens ProductCERT identified the issues, which could be exploited remotely with low attack complexity, scoring up to 5.5 CVSS. This incident highlights growing concerns over ICS (Industrial Control Systems) vulnerabilities due to their essential role in critical infrastructure and the rising sophistication of exploitation tactics targeting web interfaces. The disclosure underscores the need for proactive patch management and access restrictions amid evolving regulatory and threat environments.
6 months ago
Kill Chain
Fuji Electric HMI 2025: Buffer Overflow Exposes Critical Manufacturing Risks
In November 2025, vulnerabilities were disclosed in the Fuji Electric Monitouch V-SFT-6 HMI software (version 6.2.7.0), exposing critical manufacturing environments worldwide to potential compromise. Security researchers discovered both heap-based and stack-based buffer overflow flaws, which could allow a malicious user, via specially crafted project files, to crash targeted devices or execute arbitrary code. While there has been no evidence of active exploitation or remote attacks reported, these vulnerabilities highlight the exposed attack surface for industrial control system (ICS) operators. Following responsible disclosure, Fuji Electric addressed the issues in the October update, urging all users to upgrade immediately. This incident underscores the growing risk posed by supply chain and software vulnerabilities in critical infrastructure. With attackers increasingly targeting ICS and operational technology (OT) environments, prompt patching and layered defense strategies are more important than ever.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports