✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
2025 Siemens Spectrum Power 4 Flaws: Privilege Escalation in Critical ICS
In November 2025, Siemens disclosed a set of severe vulnerabilities impacting its Spectrum Power 4 platform, a widely deployed solution in the global energy sector. Discovered by researchers at Limes Security and reported through Siemens ProductCERT, these issues include incorrect use of privileged APIs, flawed privilege assignment, and insecure permissions, collectively enabling remote and local attackers to execute arbitrary code with administrative privileges or extract sensitive credentials. While there are currently no reports of active exploitation, the vulnerabilities expose critical infrastructure operators to the risk of operational disruption and data compromise. This incident highlights persistent threats due to weak privilege controls and insecure configurations in industrial control systems (ICS), which are increasingly targeted by sophisticated actors. With the energy sector classified as critical infrastructure, such exposures have regulatory, safety, and reputational consequences, driving renewed urgency for timely patch management and robust network segmentation.
6 months ago
Kill Chain
Mitsubishi Electric 2025: Denial-of-Service Vulnerability Impacts Industrial Control Systems
In November 2025, a denial-of-service (DoS) vulnerability (CVE-2025-10259) impacting Mitsubishi Electric MELSEC iQ-F Series programmable logic controllers was publicly disclosed. Researchers from Zhongguancun Laboratory and Tsinghua University identified that improper validation in the TCP communication module allowed remote attackers to send specially crafted TCP packets, causing affected devices to disconnect and become temporarily unresponsive. The vulnerability (CVSS 5.3) requires no authentication and can be exploited remotely, posing a notable risk to industrial control systems in the critical manufacturing sector worldwide. This incident highlights persistent cybersecurity weaknesses in industrial IoT and critical infrastructure devices, which attackers increasingly target to disrupt operations. As regulatory expectations and threat actor sophistication rise, even moderate-severity flaws in ICS environments must be prioritized and mitigated decisively.
6 months ago
Kill Chain
Rockwell Automation FactoryTalk DataMosaix: 2025 ICS Cloud Vulnerabilities Expose Industrial Risk
In November 2025, Rockwell Automation disclosed two critical vulnerabilities in its FactoryTalk DataMosaix Private Cloud platform, widely used across critical manufacturing sectors. The flaws include a weak authentication mechanism (CVE-2025-11084) that enables attackers to bypass MFA and gain unauthorized access, and a persistent cross-site scripting bug (CVE-2025-11085) that could facilitate account takeover, credential theft, or redirecting users to malicious sites. Rockwell and CISA jointly warned that attackers could exploit these remotely and potentially take control of sensitive ICS data or operations globally, demanding urgent updates. These vulnerabilities underscore rising risks tied to identity-driven attacks and web-based threats targeting industrial control environments. With Ransomware-as-a-Service and supply chain attacks escalating, organizations in critical sectors face mounting pressure to implement multi-layered controls and update legacy authentication practices.
6 months ago
Kill Chain
Siemens Solid Edge 2025: Improper Certificate Validation Exposes Critical Manufacturing to MITM Attacks
In November 2025, Siemens disclosed a critical vulnerability in its Solid Edge SE2025 product, identified as CVE-2025-40744. This software flaw, stemming from improper certificate validation in the License Service endpoint, allows unauthenticated remote attackers to perform man-in-the-middle (MITM) attacks by intercepting or manipulating encrypted traffic. The issue, rated 8.7 (CVSS v4), affects all versions of Solid Edge SE2025 prior to V225.0 Update 11, putting global critical manufacturing environments at risk of credential interception and data exposure. This incident reflects increasing attacker focus on exploiting certificate validation weaknesses in supply chain and industrial environments. With industrial control systems often at the core of large enterprises' operations, such vulnerabilities demand swift patching and ongoing vigilance in authentication and encrypted traffic controls.
6 months ago
Kill Chain
AVEVA Edge 2025: Cryptographic Weakness Leaves Critical Manufacturing at Risk
In November 2025, AVEVA disclosed a critical vulnerability (CVE-2025-9317) in its Edge HMI/SCADA software (versions 2023 R2 and prior), stemming from the use of a broken or risky cryptographic algorithm. The flaw allows local attackers with read access to Edge project or cache files to reverse engineer both application-native and Active Directory passwords via brute-force techniques. This security gap exposes organizations using AVEVA Edge in the critical manufacturing sector to unauthorized credential recovery, potentially impacting operational technology environments on a global scale. The incident highlights increased scrutiny of industrial control software security, especially against a backdrop of escalating supply chain and OT attacks. Regulatory and compliance pressures are intensifying, and organizations are urged to prioritize cryptographic hygiene, proactive patching, and strict access controls to mitigate insider and lateral threat risks.
6 months ago
Kill Chain
Critical ICS Vulnerabilities in Siemens SICAM P850/P855 Devices Impact Energy Sector
In November 2025, Siemens disclosed vulnerabilities affecting their SICAM P850 and P855 industrial control device families. Specifically, these products were susceptible to a Cross-Site Request Forgery (CSRF) flaw and incorrect permission assignment for critical resources, allowing attackers to execute unauthorized actions or impersonate users. The weaknesses impacted devices globally deployed in energy-critical infrastructure, with the main risk being attackers exploiting web sessions to modify device configuration or gain prolonged unauthorized access. Siemens ProductCERT identified the issues, which could be exploited remotely with low attack complexity, scoring up to 5.5 CVSS. This incident highlights growing concerns over ICS (Industrial Control Systems) vulnerabilities due to their essential role in critical infrastructure and the rising sophistication of exploitation tactics targeting web interfaces. The disclosure underscores the need for proactive patch management and access restrictions amid evolving regulatory and threat environments.
6 months ago
Kill Chain
Rockwell Automation SIS Workstation Vulnerability Exposes Critical Manufacturing
In November 2025, Rockwell Automation disclosed a critical path traversal vulnerability (CVE-2024-48510) in its AADvance-Trusted SIS Workstation software, impacting versions 2.00.00 to 2.00.04. The flaw stems from improper validation in the DotNetZip component, enabling remote attackers to execute arbitrary code if a victim opens a malicious file. This issue poses significant risks to critical manufacturing systems worldwide, potentially allowing adversaries to compromise safety instrumented system environments. Rockwell has released a patch in version 2.01.00 to address the flaw. This vulnerability is particularly noteworthy due to its low attack complexity, remote exploitability, and potential for widespread impact across global critical infrastructure. The incident underscores ongoing supply chain risks in industrial software and the urgent need for timely patching, robust endpoint security, and defense-in-depth strategies for operational technology (OT) environments.
6 months ago
Kill Chain
Critical Siemens LOGO! 8 Vulnerabilities Put Global ICS at Risk
In November 2025, Siemens disclosed multiple critical vulnerabilities affecting its LOGO! 8 BM Devices, widely deployed in global commercial facilities and transportation systems. Security researchers from Thales Cybersecurity Services Australia identified flaws enabling unauthenticated remote attackers to exploit classic buffer overflow and missing authentication vulnerabilities. These flaws could allow malicious actors to execute arbitrary code, disrupt device operations via denial-of-service, or modify critical device parameters such as IP address and time settings, potentially impacting industrial operations. The incident underscores growing concerns about the security posture of industrial control systems (ICS), as attackers increasingly target remote management features lacking modern authentication. With regulatory scrutiny intensifying and attackers exploiting similar flaws in operational technology, organizations must prioritize ICS security and proactive patch management to reduce exposure.
6 months ago
Kill Chain
Malicious NuGet Packages Drop Sabotage Time Bombs in 2024 Supply Chain Attack
In early June 2024, security researchers uncovered a targeted supply-chain attack involving several malicious NuGet packages. These packages, posing as legitimate software dependencies, contained 'time bomb' sabotage payloads programmed to activate years in the future—specifically in 2027 and 2028. The malicious code was designed to disrupt database operations and potentially target Siemens S7 industrial control systems, representing a novel form of delayed-detonation supply chain attack. The technique leverages trust in package ecosystems, making detection difficult and threatening both IT and operational technology environments with considerable disruption. This incident highlights an emerging trend where attackers plant long-term, stealthy threats within software supply chains to evade short-term detection and maximize impact. With the increasing adoption of open-source components and growing regulatory scrutiny, organizations must urgently reassess their software sourcing and supply-chain risk controls.
6 months ago
Kill Chain
Time-Bomb Malware Hidden in NuGet Packages Signals Alarming Supply Chain Threat
In 2023 and 2024, a set of nine malicious NuGet packages, attributed to the user 'shanhai666', were found to infect software supply chains by deploying time-delayed logic bombs. These packages, available through the official NuGet repository, hid code designed to execute malicious activities—such as sabotaging database operations and corrupting industrial control systems—on predefined future dates starting in August 2027. The sophisticated campaign leveraged delayed payload triggers, allowing attackers to infiltrate developer environments undetected for years before activation, thus maximizing potential operational and business disruption. This incident highlights the ongoing risks facing software supply chains, where attackers increasingly employ delayed and concealed attack mechanisms to evade early detection. Businesses across all sectors relying on third-party code repositories must reinforce supply chain security practices and continuously monitor for latent threats that could surface well after initial compromise.
6 months ago
Kill Chain
Advantech DeviceOn/iEdge 2025: Multiple Path Traversal and XSS Vulnerabilities Threaten IoT Security
In November 2025, security researchers disclosed multiple critical vulnerabilities in Advantech’s DeviceOn/iEdge IoT management platform, affecting version 2.0.2 and earlier. Among the vulnerabilities were improper input handling flaws including cross-site scripting (CVE-2025-64302) and several variants of path traversal (CVE-2025-62630, CVE-2025-59171, CVE-2025-58423), which could allow remote attackers to gain unauthorized access, execute arbitrary code, trigger denial-of-service conditions, or read sensitive files. No public exploitation has been reported, but the potential risks span information leakage and remote code execution, with system-level impact possible from authenticated and unauthenticated attackers. This incident is particularly relevant as IoT management and industrial control environments remain popular targets for exploitation of legacy systems, which often lack timely security updates. With operational continuity and data integrity at risk, organizations face mounting regulatory and business pressure to retire end-of-life products and implement robust remediation strategies.
6 months ago
Kill Chain
ABB FLXeon 2025 ICS Vulnerabilities: Protecting Critical Infrastructure from Remote Threats
In November 2025, ABB disclosed critical vulnerabilities affecting their FLXeon industrial control system (ICS) controllers, including the FBXi, FBVi, FBTi, and CBXi product lines. Security researcher Gjoko Krstikj of Zero Science Lab identified flaws such as the use of hard-coded credentials (CVE-2024-48842), improper input validation (CVE-2024-48851, CVE-2025-10207), and weak password hashing practices (CVE-2025-10205) that could allow remote attackers to gain control, execute arbitrary code, or cause system crashes. While exploitation requires some privileges and network access, the flaws impact ICS deployments globally, exposing critical infrastructure sectors to risk until patches are applied. This incident highlights the continued trend of vulnerabilities in operational technology and industrial systems, reinforcing fears that ICS environments remain attractive targets for cyber threat actors. As regulatory and industry pressure mounts for robust ICS security and segmentation, organizations must accelerate adoption of defense-in-depth strategies to protect essential infrastructure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports