✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Festo LX Appliance Security Alert: 2025 Cross-Site Scripting Vulnerability Exposes ICS Risks
In December 2025, Festo SE & Co. KG disclosed a cross-site scripting (XSS) vulnerability (CVE-2021-23414) affecting the Festo LX Appliance, impacting versions released before June 2023. Malicious actors could exploit improper input neutralization in the 'track' tag's 'src' attribute to execute arbitrary code by crafting a malicious course, potentially compromising highly privileged user accounts. Though no public exploitation has been reported, the vulnerability posed risks to organizations in critical sectors globally, with a CVSS v3.1 base score of 6.1 indicating a moderate threat profile. This incident underscores the persistent risks posed by web application vulnerabilities in ICS and OT environments. With the increased digitization of operational systems and ongoing cyberattacks targeting critical infrastructure, rapid identification, patching, and monitoring of such flaws remain crucial to protect sensitive assets and maintain compliance with evolving regulatory standards.
6 months ago
Kill Chain
CISA 2025 Advisories Expose Widespread ICS Vulnerabilities in Critical Infrastructure
On December 4, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued nine Industrial Control Systems (ICS) advisories after identifying multiple vulnerabilities across key ICS products from major vendors such as Mitsubishi Electric, Johnson Controls, Sunbird, SolisCloud, Advantech, and others. While no active exploitation was confirmed at the time of disclosure, these vulnerabilities—ranging from insufficient access controls and weak encryption to improper input validation—expose critical industrial environments to potential risks including remote code execution, credential compromise, and unauthorized access. The advisories underscore the wide attack surface present in operational technology (OT) and outline mitigation steps for affected organizations. The coordinated disclosure highlights the urgent need for ICS operators to address cybersecurity weaknesses as attackers increasingly target industrial networks. With OT/IT convergence, a sharp rise in ransomware, and persistent geopolitical tensions, these advisories reinforce the imperative for proactive patch management, microsegmentation, encrypted traffic, and continuous OT monitoring to prevent disruptive and costly breaches.
6 months ago
Kill Chain
CISA Flags OpenPLC ScadaBR Vulnerability Amid Active Exploitation in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-26828, an unrestricted file upload vulnerability impacting OpenPLC ScadaBR systems, to its Known Exploited Vulnerabilities (KEV) catalog after evidence emerged of active exploitation. This vulnerability allows attackers to upload malicious files to vulnerable systems, potentially enabling remote code execution or complete system takeover. Threat actors have exploited this flaw as an entry vector to target operational technology (OT) and industrial control system (ICS) environments, posing a significant risk for both federal agencies and the private sector reliant on automation and SCADA networks. The incident highlights the persistent threat to critical infrastructure from unpatched software and the growing focus of attackers on OT/ICS vulnerabilities. With regulatory directives like CISA’s BOD 22-01 mandating urgent remediation, organizations face increasing accountability for securing their environments against rapidly evolving exploits.
6 months ago
Kill Chain
Iskra iHUB 2025: Missing Authentication Exposes Critical Energy Infrastructure
In December 2025, a critical vulnerability (CVE-2025-13510) was disclosed for Iskra iHUB and iHUB Lite smart metering gateways, extensively used in the global energy sector. The devices exposed a web management interface lacking authentication, allowing remote attackers to reconfigure settings, update firmware, or manipulate connected systems without needing valid credentials. Reported by researcher Souvik Kandar and publicized by CISA, the issue affected all versions of these products, placing energy utilities at heightened risk. Successful exploitation could compromise grid operations, disrupt data collection, and enable broader attacks on critical infrastructure. This incident underscores the persistent risk of weak or missing authentication in industrial control systems amid heightened regulatory scrutiny. As similar vulnerabilities drive attacks on critical infrastructure worldwide, energy sector organizations must urgently reevaluate their security postures against remotely exploitable threats and adopt robust access controls in alignment with zero trust principles.
6 months ago
Kill Chain
Critical RCE Flaw in Industrial Video & Control Longwatch Threatens Global OT Networks
In December 2025, a critical remote code execution vulnerability (CVE-2025-13658) was discovered in Industrial Video & Control’s Longwatch systems (versions 6.309 to 6.334). An unauthenticated attacker could exploit a lack of access controls and code signing via an exposed HTTP endpoint, gaining SYSTEM-level privileges across vulnerable energy and water infrastructure deployments worldwide. This exploitation method requires minimal technical expertise and impacts operational technology (OT) integrity in sectors fundamental to public safety. This vulnerability exemplifies persistent gaps in OT device security and comes amid heightened global concerns around the security of essential infrastructure. With regulatory scrutiny and sophistication of attacker tactics increasing, organizations must urgently address privilege escalation routes and remote code execution exposures within their ICS/SCADA environments.
6 months ago
Kill Chain
CISA Unveils 2025 Critical ICS Vulnerabilities Affecting Industrial and Medical Sectors
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five separate advisories detailing multiple vulnerabilities discovered across widely deployed industrial control systems (ICS) products, including platforms from Industrial Video & Control, Iskra, Mirion Medical, and Mitsubishi Electric. These vulnerabilities range from improper authentication and unencrypted data flows to weak access controls and, if left unmitigated, could enable threat actors to compromise critical infrastructure, hijack remote operations, or disrupt medical and industrial processes. The affected organizations were notified, and remediation guidance was provided to reduce risk and limit exploitation by sophisticated actors. This disclosure underscores an ongoing trend of vulnerability discoveries in ICS environments, where legacy protocols, insufficient segmentation, and growing connectivity increasingly expose operational networks to targeted attacks. Continued disclosures by agencies like CISA emphasize the urgent need for robust visibility, segmentation, and zero trust architectures in protecting critical infrastructure.
6 months ago
Kill Chain
CISA Flags OpenPLC ScadaBR XSS Flaw (CVE-2021-26829) as Actively Exploited in ICS Environments
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-26829—a cross-site scripting (XSS) vulnerability affecting OpenPLC ScadaBR software—to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaw impacts both Windows and Linux versions of ScadaBR, a commonly used open-source SCADA platform. Attackers leveraged the XSS flaw to execute arbitrary scripts, posing significant risk to system integrity and exposing critical infrastructure operators to potential business disruption, data compromise, and malicious control of automation processes. This incident reflects the growing trend of adversaries targeting industrial control systems (ICS) via supply chain and application-layer vulnerabilities. With regulatory scrutiny rising and CISA actively tracking exploited flaws, securing OT and SCADA environments is critical to mitigate operational and safety risks posed by unpatched vulnerabilities.
6 months ago
Kill Chain
CVE-2021-26829: ScadaBR XSS Exploitation Prompts CISA Catalog Action
In November 2025, CISA added CVE-2021-26829, an OpenPLC ScadaBR cross-site scripting (XSS) vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after observing active exploitation. Adversaries exploited a lack of proper input sanitization in ScadaBR—a widely used industrial automation software—to inject malicious scripts, enabling credential theft or unauthorized actions on affected systems. The vulnerability increases the risk of lateral movement within critical infrastructure and highlights the susceptibility of operational technology (OT) environments to common web-based attacks. Federal agencies are mandated to remediate such vulnerabilities, reflecting their high-risk nature and operational impact. This incident underscores a broader trend: threat actors are increasingly exploiting web application vulnerabilities in industrial and critical network environments. The addition to the KEV catalog reflects regulatory focus on timely remediation, as attacks targeting core OT platforms can cause serious operational disruption and regulatory exposure.
6 months ago
Kill Chain
Rockwell Automation Arena Simulation Buffer Overflow (2025): Risks to Industrial Control Systems
In November 2025, Rockwell Automation disclosed a stack-based buffer overflow vulnerability (CVE-2025-11918) in its Arena Simulation software (versions 16.20.10 and earlier). The flaw, reported by security researcher Michael Heinzl, enables local attackers to execute arbitrary code by tricking users into opening a malicious DOE file. While the vulnerability is not exploitable remotely, it presents a significant risk to organizations leveraging Arena for critical manufacturing automation, especially when adequate segmentation and endpoint security controls are lacking. No public exploitation has been reported to date, and the vendor has released a security update to address the issue. This incident is a reminder of the persistence of file parsing vulnerabilities in industrial software, which continue to enable initial compromise via local vectors like engineered files or insider threats. The increase in similar vulnerabilities and the possibility of operational technology (OT) system breaches intensify the call for zero-trust and defense-in-depth strategies within the manufacturing sector.
6 months ago
Kill Chain
Opto 22 groov View: 2025 ICS Vulnerability Exposes API Keys & Credentials
In November 2025, Opto 22 disclosed a critical vulnerability (CVE-2025-13084) affecting its groov View industrial control platform, impacting versions of groov View Server for Windows and GRV-EPIC firmware. Security researchers from Meta identified that the API's users endpoint could inadvertently expose all user metadata, including API keys and credentials—even those for administrator accounts—when accessed by users with Editor privileges. Although exploitation requires already having Editor-level access, a successful attack could result in full privilege escalation, credential compromise, and unauthorized access across critical manufacturing environments worldwide. This incident highlights ongoing risks in industrial control systems (ICS) where sensitive data is exposed through insufficient API controls. The breach underscores the rising importance of strict segmentation, encrypted traffic management, and proactive patch management in ICS environments, especially as remote exploitation and metadata exposure attacks become more common.
6 months ago
Kill Chain
Festo ICS Hidden Function Flaw Raises Global Manufacturing Security Stakes
In November 2025, Festo SE & Co. KG disclosed a critical security vulnerability (CVE-2023-3634) in its MSE6-C2M/D2M/E2M industrial control modules. The flaw, caused by hidden functionality accessible to remote, low-privileged authenticated users, could enable attackers to trigger undocumented test modes leading to a complete loss of confidentiality, integrity, and availability across affected devices. Operations worldwide in the critical manufacturing sector were potentially exposed due to this vulnerability, rated CVSS 8.8, though no evidence of active exploitation was reported. The issue prompted coordinated advisories from CERT@VDE and CISA, highlighting the systemic risk to industrial automation environments. This incident highlights ongoing threats to operational technology (OT) and industrial control systems, as the trend of exploiting hidden or undocumented features grows. With manufacturing and critical infrastructure increasingly interconnected, such vulnerabilities pose a greater risk of targeted disruptions and underscore the urgent need for proactive cybersecurity and compliance safeguards in OT environments.
6 months ago
Kill Chain
Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk
In November 2025, Festo SE & Co. KG disclosed a supply chain vulnerability affecting its Didactic products due to the integration of vulnerable versions of Siemens TIA Portal (V15–V18). The issue, tracked as CVE-2023-26293, stems from improper input validation, allowing attackers to leverage a path traversal flaw. This could result in the creation or overwriting of arbitrary files if a user is tricked into opening a malicious PC system configuration file, leading to potential arbitrary code execution. The exploit, which requires local access with user interaction, impacts engineering systems used globally across critical sectors, including manufacturing, energy, communications, and commercial facilities. This vulnerability is significant as it illustrates the increasing prevalence of supply chain risks in industrial and critical infrastructure software. With threat actors increasingly exploiting the software supply chain and user-driven entry vectors, maintaining rigorous update and validation processes has become a pressing challenge for organizations worldwide.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports