The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
CSRF Flaw in OpenPLC_V3 Sheds Light on ICS Software Security Risks
In December 2025, a significant cybersecurity vulnerability was disclosed in OpenPLC_V3, an open-source programmable logic controller widely deployed in critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. Researchers identified a Cross-Site Request Forgery (CSRF) flaw (CVE-2025-13970) that allowed remote, unauthenticated attackers to exploit absent CSRF protections, potentially tricking logged-in administrators into modifying PLC settings or uploading malicious code. This could have caused disruptive or destructive changes to industrial processes. A patch was promptly released via pull request #310, and no evidence of public exploitation has been reported to date. The incident underscores growing threats to industrial control system (ICS) environments, as attackers increasingly target device management interfaces. Regulatory and industry attention remains high, amplifying requirements for strong authentication, network segmentation, and timely vulnerability management for ICS software.
8 months ago
Kill Chain
Siemens Discloses Physical Access Flaw in 2025 G5DFR Devices
In December 2025, Siemens Energy Services disclosed a critical vulnerability in all G5DFR versions of its Elspec G5 devices, affecting industrial control systems worldwide. Attackers with physical access could reset the Admin password by inserting a USB drive containing a public reset string, effectively bypassing authentication (CVE-2025-59392, CVSS 7.0). While exploitation required direct device access, successful attacks would allow unauthorized changes to critical system configurations, risking operational integrity within the energy sector. Siemens and CISA advised urgent firmware updates and robust network isolation to mitigate the risk. This incident highlights the persistent risk of physical-layer threats in critical infrastructure environments, even as digital attack surfaces expand. The availability of public reset procedures underscores the urgency in securing endpoints and the importance of layered, defense-in-depth strategies, especially given the evolving regulatory landscape and increased scrutiny on energy sector cybersecurity.
8 months ago
Kill Chain
Authentication Bypass Exposes Siemens Gridscale X Prepay ICS: 2025 Breach Analysis
In December 2025, Siemens disclosed critical vulnerabilities impacting its Gridscale X Prepay solution, widely used in energy infrastructure. The flaws—an observable response discrepancy (CVE-2025-40806) and authentication bypass via capture-replay (CVE-2025-40807)—could allow remote attackers to enumerate valid user names and circumvent lockouts, compromising operational security. Discovered by Kira of The Raven Security and coordinated via Siemens ProductCERT and CISA, these issues placed globally deployed ICS systems at risk of unauthorized access by leveraging predictable system responses and token replay, potentially impacting sensitive control environments. This incident highlights an ongoing trend of attackers exploiting authentication weaknesses in industrial control systems, underscoring the need for strict access management and timely vulnerability mitigation. With ICS assets increasingly targeted and regulatory scrutiny rising, implementing robust segmentation and monitoring is more crucial than ever.
8 months ago
Kill Chain
CISA Warns of Multiple ICS Vulnerabilities in U-Boot, Festo LX, and CCTV Devices (2025)
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released advisories on three newly discovered vulnerabilities affecting critical components in industrial environments: Universal Boot Loader (U-Boot), Festo LX Appliances, and multiple India-based CCTV cameras. These advisories highlight exploitable weaknesses that could allow threat actors to compromise device integrity, execute unauthorized commands, or pivot deeper into industrial networks, potentially disrupting operations or stealing sensitive data. The vulnerabilities impact a broad range of operational technology (OT) deployments and may require urgent patching or mitigation to prevent exploitation. This incident underscores the increasing volume and diversity of attacks targeting industrial control systems and OT environments. As digital transformation deepens, threat actors continue to capitalize on unpatched systems and weak security controls in critical infrastructure, raising the risks for sectors reliant on ICS technology.
8 months ago
Kill Chain
Festo LX Appliance Security Alert: 2025 Cross-Site Scripting Vulnerability Exposes ICS Risks
In December 2025, Festo SE & Co. KG disclosed a cross-site scripting (XSS) vulnerability (CVE-2021-23414) affecting the Festo LX Appliance, impacting versions released before June 2023. Malicious actors could exploit improper input neutralization in the 'track' tag's 'src' attribute to execute arbitrary code by crafting a malicious course, potentially compromising highly privileged user accounts. Though no public exploitation has been reported, the vulnerability posed risks to organizations in critical sectors globally, with a CVSS v3.1 base score of 6.1 indicating a moderate threat profile. This incident underscores the persistent risks posed by web application vulnerabilities in ICS and OT environments. With the increased digitization of operational systems and ongoing cyberattacks targeting critical infrastructure, rapid identification, patching, and monitoring of such flaws remain crucial to protect sensitive assets and maintain compliance with evolving regulatory standards.
8 months ago
Kill Chain
CISA 2025 Advisories Expose Widespread ICS Vulnerabilities in Critical Infrastructure
On December 4, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued nine Industrial Control Systems (ICS) advisories after identifying multiple vulnerabilities across key ICS products from major vendors such as Mitsubishi Electric, Johnson Controls, Sunbird, SolisCloud, Advantech, and others. While no active exploitation was confirmed at the time of disclosure, these vulnerabilities—ranging from insufficient access controls and weak encryption to improper input validation—expose critical industrial environments to potential risks including remote code execution, credential compromise, and unauthorized access. The advisories underscore the wide attack surface present in operational technology (OT) and outline mitigation steps for affected organizations. The coordinated disclosure highlights the urgent need for ICS operators to address cybersecurity weaknesses as attackers increasingly target industrial networks. With OT/IT convergence, a sharp rise in ransomware, and persistent geopolitical tensions, these advisories reinforce the imperative for proactive patch management, microsegmentation, encrypted traffic, and continuous OT monitoring to prevent disruptive and costly breaches.
8 months ago
Kill Chain
CISA Flags OpenPLC ScadaBR Vulnerability Amid Active Exploitation in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-26828, an unrestricted file upload vulnerability impacting OpenPLC ScadaBR systems, to its Known Exploited Vulnerabilities (KEV) catalog after evidence emerged of active exploitation. This vulnerability allows attackers to upload malicious files to vulnerable systems, potentially enabling remote code execution or complete system takeover. Threat actors have exploited this flaw as an entry vector to target operational technology (OT) and industrial control system (ICS) environments, posing a significant risk for both federal agencies and the private sector reliant on automation and SCADA networks. The incident highlights the persistent threat to critical infrastructure from unpatched software and the growing focus of attackers on OT/ICS vulnerabilities. With regulatory directives like CISA’s BOD 22-01 mandating urgent remediation, organizations face increasing accountability for securing their environments against rapidly evolving exploits.
8 months ago
Kill Chain
Iskra iHUB 2025: Missing Authentication Exposes Critical Energy Infrastructure
In December 2025, a critical vulnerability (CVE-2025-13510) was disclosed for Iskra iHUB and iHUB Lite smart metering gateways, extensively used in the global energy sector. The devices exposed a web management interface lacking authentication, allowing remote attackers to reconfigure settings, update firmware, or manipulate connected systems without needing valid credentials. Reported by researcher Souvik Kandar and publicized by CISA, the issue affected all versions of these products, placing energy utilities at heightened risk. Successful exploitation could compromise grid operations, disrupt data collection, and enable broader attacks on critical infrastructure. This incident underscores the persistent risk of weak or missing authentication in industrial control systems amid heightened regulatory scrutiny. As similar vulnerabilities drive attacks on critical infrastructure worldwide, energy sector organizations must urgently reevaluate their security postures against remotely exploitable threats and adopt robust access controls in alignment with zero trust principles.
8 months ago
Kill Chain
Critical RCE Flaw in Industrial Video & Control Longwatch Threatens Global OT Networks
In December 2025, a critical remote code execution vulnerability (CVE-2025-13658) was discovered in Industrial Video & Control’s Longwatch systems (versions 6.309 to 6.334). An unauthenticated attacker could exploit a lack of access controls and code signing via an exposed HTTP endpoint, gaining SYSTEM-level privileges across vulnerable energy and water infrastructure deployments worldwide. This exploitation method requires minimal technical expertise and impacts operational technology (OT) integrity in sectors fundamental to public safety. This vulnerability exemplifies persistent gaps in OT device security and comes amid heightened global concerns around the security of essential infrastructure. With regulatory scrutiny and sophistication of attacker tactics increasing, organizations must urgently address privilege escalation routes and remote code execution exposures within their ICS/SCADA environments.
8 months ago
Kill Chain
CISA Unveils 2025 Critical ICS Vulnerabilities Affecting Industrial and Medical Sectors
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five separate advisories detailing multiple vulnerabilities discovered across widely deployed industrial control systems (ICS) products, including platforms from Industrial Video & Control, Iskra, Mirion Medical, and Mitsubishi Electric. These vulnerabilities range from improper authentication and unencrypted data flows to weak access controls and, if left unmitigated, could enable threat actors to compromise critical infrastructure, hijack remote operations, or disrupt medical and industrial processes. The affected organizations were notified, and remediation guidance was provided to reduce risk and limit exploitation by sophisticated actors. This disclosure underscores an ongoing trend of vulnerability discoveries in ICS environments, where legacy protocols, insufficient segmentation, and growing connectivity increasingly expose operational networks to targeted attacks. Continued disclosures by agencies like CISA emphasize the urgent need for robust visibility, segmentation, and zero trust architectures in protecting critical infrastructure.
8 months ago
Kill Chain
CISA Flags OpenPLC ScadaBR XSS Flaw (CVE-2021-26829) as Actively Exploited in ICS Environments
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-26829—a cross-site scripting (XSS) vulnerability affecting OpenPLC ScadaBR software—to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaw impacts both Windows and Linux versions of ScadaBR, a commonly used open-source SCADA platform. Attackers leveraged the XSS flaw to execute arbitrary scripts, posing significant risk to system integrity and exposing critical infrastructure operators to potential business disruption, data compromise, and malicious control of automation processes. This incident reflects the growing trend of adversaries targeting industrial control systems (ICS) via supply chain and application-layer vulnerabilities. With regulatory scrutiny rising and CISA actively tracking exploited flaws, securing OT and SCADA environments is critical to mitigate operational and safety risks posed by unpatched vulnerabilities.
8 months ago
Kill Chain
CVE-2021-26829: ScadaBR XSS Exploitation Prompts CISA Catalog Action
In November 2025, CISA added CVE-2021-26829, an OpenPLC ScadaBR cross-site scripting (XSS) vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after observing active exploitation. Adversaries exploited a lack of proper input sanitization in ScadaBR—a widely used industrial automation software—to inject malicious scripts, enabling credential theft or unauthorized actions on affected systems. The vulnerability increases the risk of lateral movement within critical infrastructure and highlights the susceptibility of operational technology (OT) environments to common web-based attacks. Federal agencies are mandated to remediate such vulnerabilities, reflecting their high-risk nature and operational impact. This incident underscores a broader trend: threat actors are increasingly exploiting web application vulnerabilities in industrial and critical network environments. The addition to the KEV catalog reflects regulatory focus on timely remediation, as attacks targeting core OT platforms can cause serious operational disruption and regulatory exposure.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports