✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
2025 Shelly Pro 3EM ICS Flaw Exposes Modbus Devices to DoS
In November 2025, a critical Out-of-Bounds Read vulnerability (CVE-2025-12056) was disclosed in the Shelly Pro 3EM, a smart DIN rail switch used in industrial control systems worldwide. Security researchers revealed that a specially crafted Modbus request allows attackers on the adjacent network to trigger an illegal memory access, causing a denial-of-service condition by repeatedly rebooting the device. All versions of the Pro 3EM are affected, including deployments across critical manufacturing sectors. Shelly did not issue an official response, leaving users to rely on CISA defensive guidance. This incident exemplifies the growing risk of targeted vulnerabilities in widely deployed OT (operational technology) and industrial IoT devices. As criminals and nation-state actors increasingly focus on ICS and critical infrastructure, maintaining robust segmentation, access controls, and secure outbound communications is more relevant than ever.
6 months ago
Kill Chain
AVEVA 2025: XSS Vulnerability in Application Server IDE Threatens Industrial Security
In November 2025, AVEVA disclosed a critical security vulnerability (CVE-2025-8386) in its Application Server IDE, exposing numerous organizations in the critical manufacturing sector worldwide. The flaw, classified as an Improper Neutralization of Script-Related HTML Tags (CWE-80), allows authenticated users with elevated permissions to tamper with application help files and persistently inject cross-site scripting (XSS) payloads. If exploited during configuration-time operations, malicious code can trigger upon subsequent access by other users, resulting in horizontal or vertical privilege escalation. While only affective at config-time and not impacting runtime components, the risk is heightened due to widespread industrial deployments. This incident underscores persistent challenges in securing industrial software, as XSS and privilege escalation vulnerabilities remain a significant vector for lateral attacker movement. The AVEVA disclosure demonstrates the urgency for robust privilege auditing and regular patching, especially as attackers increasingly target industrial environments for both espionage and disruption.
6 months ago
Kill Chain
Rockwell Automation 2025 ICS Vulnerabilities: Studio 5000 Path Traversal & SSRF Risks
In November 2025, Rockwell Automation disclosed critical vulnerabilities affecting its Studio 5000 Simulation Interface used across chemical and manufacturing sectors. The issues—Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-11696) and Server-Side Request Forgery (CVE-2025-11697)—allowed local attackers to execute arbitrary scripts with administrator privileges and capture NTLM hashes via outbound SMB requests. The vulnerabilities impacted versions 2.02 and earlier, and, if exploited, could grant attackers lateral movement or privileged control within industrial environments, threatening operational integrity and sensitive data. These vulnerabilities highlight ongoing threats to industrial control systems (ICS) and the continued focus of adversaries on exploiting misconfigurations and overlooked APIs. With increasing regulatory pressure for critical infrastructure resilience and the evolution of ICS-specific ransomware and supply chain attacks, such vulnerabilities remain a potent risk requiring constant attention and timely remediation.
6 months ago
Kill Chain
CISA Flags 18 Critical ICS Vulnerabilities Across Major Vendors
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released 18 advisories highlighting critical vulnerabilities across a wide spectrum of Industrial Control Systems (ICS) products from vendors such as Mitsubishi Electric, AVEVA, Rockwell Automation, Siemens, and others. These advisories detailed security gaps including unencrypted communications, insufficient segmentation, lack of policy enforcement, and exploitable firmware flaws. Although no specific exploitation campaigns were publicly confirmed at the time, the breadth and technical depth of the advisories underscore the ICS sector’s wide attack surface and the urgent need for robust controls and timely patching to prevent downtime, data loss, or operational safety issues. This disclosure is especially relevant given the escalating sophistication of threat actors targeting operational technology and the convergence of IT/OT networks. The incident reflects a steady increase in supply chain exposures and nation-state attention on industrial sectors, amplifying risk to critical infrastructure worldwide.
6 months ago
Kill Chain
Critical Authorization Flaw Exposes Rockwell Automation Verve Asset Manager (2025)
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2025-11862) in multiple versions of its Verve Asset Manager platform, widely used in industrial control system cybersecurity. The flaw, present from versions 1.33 up to 1.41.3, arises from an incorrect authorization configuration that allows unauthorized read-only users to perform privileged API operations, such as reading, updating, and deleting user accounts. The vulnerability, which is remotely exploitable with low attack complexity, exposes critical manufacturing environments to potential data breaches or sabotage until properly patched. Rockwell addressed the issue in version 1.41.4 and subsequent releases, urging all customers to update immediately. This incident underscores the growing risk baseline facing operational technology (OT) and ICS environments as attackers increasingly target authorization misconfigurations and API exposures. Regulatory pressure and rising sophistication in adversary tactics make strong access controls and rapid patch management more essential than ever for organizations managing critical infrastructure.
6 months ago
Kill Chain
2025 Rockwell FactoryTalk Policy Manager DoS Vulnerability Exposes Critical Manufacturing
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2024-22019) affecting versions 6.51.00 and earlier of its FactoryTalk Policy Manager, a tool widely deployed in industrial and manufacturing environments for policy enforcement and network segmentation. The flaw—tied to improper resource shutdown or release in the Node.js HTTP server—enables remote attackers to send specially crafted chunked HTTP requests that exhaust CPU and network resources, resulting in denial-of-service (DoS) conditions. While no active exploitation was reported as of publication, the vulnerability posed operational risks to OT systems globally, especially in critical manufacturing sectors. The incident underscores the risks posed by third-party software dependencies in industrial control system environments, especially as attackers target resource exhaustion vectors that bypass conventional safeguards. The disclosure highlights the increasing urgency for proactive vulnerability management and defense-in-depth strategies, given the essential role of OT in critical infrastructure.
6 months ago
Kill Chain
2025 Siemens Spectrum Power 4 Flaws: Privilege Escalation in Critical ICS
In November 2025, Siemens disclosed a set of severe vulnerabilities impacting its Spectrum Power 4 platform, a widely deployed solution in the global energy sector. Discovered by researchers at Limes Security and reported through Siemens ProductCERT, these issues include incorrect use of privileged APIs, flawed privilege assignment, and insecure permissions, collectively enabling remote and local attackers to execute arbitrary code with administrative privileges or extract sensitive credentials. While there are currently no reports of active exploitation, the vulnerabilities expose critical infrastructure operators to the risk of operational disruption and data compromise. This incident highlights persistent threats due to weak privilege controls and insecure configurations in industrial control systems (ICS), which are increasingly targeted by sophisticated actors. With the energy sector classified as critical infrastructure, such exposures have regulatory, safety, and reputational consequences, driving renewed urgency for timely patch management and robust network segmentation.
6 months ago
Kill Chain
Mitsubishi Electric 2025: Denial-of-Service Vulnerability Impacts Industrial Control Systems
In November 2025, a denial-of-service (DoS) vulnerability (CVE-2025-10259) impacting Mitsubishi Electric MELSEC iQ-F Series programmable logic controllers was publicly disclosed. Researchers from Zhongguancun Laboratory and Tsinghua University identified that improper validation in the TCP communication module allowed remote attackers to send specially crafted TCP packets, causing affected devices to disconnect and become temporarily unresponsive. The vulnerability (CVSS 5.3) requires no authentication and can be exploited remotely, posing a notable risk to industrial control systems in the critical manufacturing sector worldwide. This incident highlights persistent cybersecurity weaknesses in industrial IoT and critical infrastructure devices, which attackers increasingly target to disrupt operations. As regulatory expectations and threat actor sophistication rise, even moderate-severity flaws in ICS environments must be prioritized and mitigated decisively.
6 months ago
Kill Chain
Rockwell Automation FactoryTalk DataMosaix: 2025 ICS Cloud Vulnerabilities Expose Industrial Risk
In November 2025, Rockwell Automation disclosed two critical vulnerabilities in its FactoryTalk DataMosaix Private Cloud platform, widely used across critical manufacturing sectors. The flaws include a weak authentication mechanism (CVE-2025-11084) that enables attackers to bypass MFA and gain unauthorized access, and a persistent cross-site scripting bug (CVE-2025-11085) that could facilitate account takeover, credential theft, or redirecting users to malicious sites. Rockwell and CISA jointly warned that attackers could exploit these remotely and potentially take control of sensitive ICS data or operations globally, demanding urgent updates. These vulnerabilities underscore rising risks tied to identity-driven attacks and web-based threats targeting industrial control environments. With Ransomware-as-a-Service and supply chain attacks escalating, organizations in critical sectors face mounting pressure to implement multi-layered controls and update legacy authentication practices.
6 months ago
Kill Chain
AVEVA Edge 2025: Cryptographic Weakness Leaves Critical Manufacturing at Risk
In November 2025, AVEVA disclosed a critical vulnerability (CVE-2025-9317) in its Edge HMI/SCADA software (versions 2023 R2 and prior), stemming from the use of a broken or risky cryptographic algorithm. The flaw allows local attackers with read access to Edge project or cache files to reverse engineer both application-native and Active Directory passwords via brute-force techniques. This security gap exposes organizations using AVEVA Edge in the critical manufacturing sector to unauthorized credential recovery, potentially impacting operational technology environments on a global scale. The incident highlights increased scrutiny of industrial control software security, especially against a backdrop of escalating supply chain and OT attacks. Regulatory and compliance pressures are intensifying, and organizations are urged to prioritize cryptographic hygiene, proactive patching, and strict access controls to mitigate insider and lateral threat risks.
6 months ago
Kill Chain
Critical Flaws in General Industrial Controls Lynx+ Gateway Threaten Manufacturing Security (2025)
In November 2025, critical vulnerabilities were discovered in General Industrial Controls' Lynx+ Gateway devices deployed worldwide across the critical manufacturing sector. The exposed flaws—included weak password requirements, missing authentication for critical functions, and cleartext transmission of sensitive information—allowed attackers to remotely access devices, obtain sensitive information, and, in some cases, potentially cause denial-of-service conditions. Multiple CVEs (CVE-2025-55034, CVE-2025-58083, CVE-2025-59780, CVE-2025-62765) were assigned, with the highest CVSS v4 base score reaching 9.2. Despite coordinated disclosure efforts, the vendor did not respond, leaving organizations reliant on their own layered defense measures. This incident is highly relevant as it highlights persistent challenges in secure authentication and encrypted traffic within operational technology environments. The surge in attacks exploiting similar unauthenticated remote access and cleartext weaknesses continues to drive regulatory pressure for zero trust and encryption controls within industrial networks.
6 months ago
Kill Chain
Siemens Altair Grid Engine 2025: Local Privilege Escalation and OT Vulnerability Risks
In November 2025, Siemens disclosed two local privilege escalation vulnerabilities affecting all versions of Altair Grid Engine prior to V2026.0.0. These flaws, identified as CVE-2025-40760 (Generation of Error Message Containing Sensitive Information) and CVE-2025-40763 (Uncontrolled Search Path Element), could allow attackers with local access to extract password hashes or execute arbitrary code with superuser permissions by manipulating environment variables or error handling processes. Although there has been no evidence of exploitation in the wild, the vulnerabilities required only low attack complexity and affected critical manufacturing environments globally. This incident highlights ongoing risks posed by improper input validation and error handling in operational technology (OT) environments, especially as attackers increasingly target privilege escalation vectors. Regulatory bodies emphasize swift detection, patching, and IT/OT segmentation to reduce attack surface, as local escalation flaws remain a persistent threat vector in critical infrastructure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports