✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
Critical Vulnerability in ABB AC500 V2 PLCs: CVE-2025-7745
In July 2025, a buffer over-read vulnerability, identified as CVE-2025-7745, was discovered in ABB's AC500 V2 programmable logic controllers (PLCs), affecting versions up to and including 2.5.2. This flaw could allow unauthorized access to fragments of previously transmitted Modbus telegrams, potentially exposing sensitive information. The vulnerability was reported by Reid Wightman of Dragos, Inc., and ABB released firmware version 2.5.3 to address the issue. The incident underscores the critical importance of timely patch management in industrial control systems (ICS). As cyber threats targeting ICS environments continue to evolve, organizations must remain vigilant in updating and securing their operational technology to prevent potential exploitation of such vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerability in ABB Terra AC Wallbox Chargers: CVE-2025-5517
In October 2025, ABB disclosed a heap-based buffer overflow vulnerability (CVE-2025-5517) affecting multiple models of its Terra AC wallbox electric vehicle chargers. This flaw could allow attackers to execute arbitrary code, cause denial-of-service conditions, or gain unauthorized access. Exploitation requires either a man-in-the-middle position with unencrypted communication or a compromised Charging Station Management System (CSMS). ABB has released firmware updates to address this issue and recommends users update their devices promptly. This incident underscores the critical importance of securing industrial control systems, especially as electric vehicle infrastructure becomes more widespread. Organizations should ensure encrypted communications and regularly update firmware to mitigate such vulnerabilities.
2 months ago
Kill Chain
ABB MConfig Vulnerability CVE-2025-9970: Cleartext Storage of Sensitive Information
In October 2025, ABB disclosed a vulnerability (CVE-2025-9970) in its MConfig software versions up to 1.4.9.21, where sensitive information was stored in cleartext within memory. This flaw could allow attackers with local access to extract credentials, potentially compromising system integrity. ABB released version 1.4.9.22 to address this issue. This incident underscores the critical importance of secure memory handling practices in software development, especially for applications managing sensitive data. Organizations are reminded to promptly apply security patches and review software for similar vulnerabilities to prevent unauthorized access.
2 months ago
Kill Chain
Critical Vulnerabilities in ABB B&R Automation Runtime Threaten Industrial Systems
In October 2025, ABB B&R Automation Runtime versions prior to 6.4 were found to have multiple vulnerabilities, including CVE-2025-3449, CVE-2025-3448, and CVE-2025-11498. These flaws could allow unauthenticated attackers to hijack sessions, execute arbitrary JavaScript in users' browsers, and inject malicious formulas into CSV files. Exploitation required network access and user interaction, posing significant risks to industrial control systems. The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial automation environments. As cyber threats targeting operational technology increase, organizations must prioritize timely updates and comprehensive security practices to safeguard against potential exploits.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in ABB Terra AC Wallbox EV Chargers
In September 2025, ABB identified multiple buffer overflow vulnerabilities in its Terra AC Wallbox electric vehicle chargers, specifically affecting firmware versions up to 1.8.33. These vulnerabilities, cataloged as CVE-2025-10504, CVE-2025-12142, and CVE-2025-12143, could allow attackers with adjacent network access and high privileges to execute arbitrary code, potentially leading to unauthorized control over the device. ABB promptly released firmware version 1.8.36 to address these issues and recommended immediate updates to mitigate potential risks. The discovery of these vulnerabilities underscores the critical importance of securing IoT devices, especially those connected to critical infrastructure like energy distribution. As the adoption of electric vehicle chargers grows, ensuring robust cybersecurity measures is essential to prevent potential exploitation that could disrupt services and compromise user safety.
2 months ago
Kill Chain
Critical OpenSSL Vulnerability in Hitachi Energy's GMS600: CVE-2022-4304
In 2023, Hitachi Energy identified a vulnerability (CVE-2022-4304) in its GMS600 versions 1.3.0 and 1.3.1, stemming from a timing-based side channel in the OpenSSL RSA decryption implementation. This flaw could potentially allow attackers to recover plaintext across a network through a Bleichenbacher-style attack, necessitating the transmission of a large number of trial messages. Successful exploitation could lead to the decryption of sensitive application data transmitted over TLS connections. ([cve.mitre.org](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304&utm_source=openai)) This incident underscores the critical importance of promptly addressing vulnerabilities in widely used cryptographic libraries like OpenSSL. Organizations must remain vigilant, as similar flaws can have far-reaching implications across various products and industries, emphasizing the need for continuous monitoring and timely patching to maintain robust cybersecurity defenses.
2 months ago
Kill Chain
ScadaBR 1.2.0 Vulnerabilities: A Wake-Up Call for SCADA Security
In May 2026, multiple critical vulnerabilities were identified in ScadaBR version 1.2.0, an open-source SCADA platform widely used in critical infrastructure sectors. These vulnerabilities include missing authentication for critical functions (CVE-2026-8602), OS command injection (CVE-2026-8603), cross-site request forgery (CVE-2026-8604), and the use of hard-coded credentials (CVE-2026-8605). Exploitation of these flaws could allow unauthenticated attackers to execute arbitrary code, manipulate sensor readings, and gain administrative access to the system, posing significant risks to operational technology environments. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-scadabr-1-2-0-flaws-enable-unauthenticated-rce-protect-ot-exposure.418951/post-978793?utm_source=openai)) The discovery of these vulnerabilities underscores the ongoing challenges in securing SCADA systems, especially those exposed to the internet or integrated with IT networks. Organizations must reassess their security postures, implement robust access controls, and ensure timely updates to mitigate such risks.
2 months ago
Kill Chain
Critical Vulnerability in ABB CoreSense Products: CVE-2025-3465
In October 2025, ABB disclosed a path traversal vulnerability (CVE-2025-3465) in its CoreSense™ HM and CoreSense™ M10 products, affecting versions up to 2.3.1 and 1.4.1.12, respectively. This flaw allows unauthenticated users to access restricted directories, potentially leading to complete system compromise and exposure of sensitive information. ABB has released updates to address this issue and recommends that customers apply them promptly. This incident underscores the critical importance of timely vulnerability management in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must remain vigilant and proactive in applying security patches to mitigate potential risks.
2 months ago
Kill Chain
Critical Vulnerability in Palo Alto Networks PAN-OS: CVE-2026-0300
In May 2026, a critical buffer overflow vulnerability (CVE-2026-0300) was identified in the User-ID™ Authentication Portal service of Palo Alto Networks PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability affects PAN-OS versions prior to 12.1.4-h5, 11.2.4-h17, 11.1.4-h33, and 10.2.7-h34. Exploitation has been observed in the wild, primarily targeting systems with the Authentication Portal exposed to untrusted networks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The incident underscores the importance of securing network access to critical services and adhering to best practice guidelines. Organizations are advised to restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses and apply the necessary software updates promptly to mitigate potential risks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
2 months ago
Kill Chain
Iranian Hackers Compromise U.S. Fuel Monitoring Systems in 2026
In May 2026, Iranian hackers reportedly breached automatic tank gauge (ATG) systems monitoring fuel levels at gas stations across multiple U.S. states. These systems, exposed online without password protection, allowed attackers to alter display readings without affecting actual fuel levels. While no physical damage occurred, the incident underscores vulnerabilities in critical infrastructure. ([abc17news.com](https://abc17news.com/politics/national-politics/cnn-us-politics/2026/05/15/exclusive-hackers-have-breached-tank-readers-at-us-gas-stations-officials-suspect-iran-is-responsible/?utm_source=openai)) This breach highlights the evolving nature of cyber warfare, where nation-state actors target essential services. The incident serves as a stark reminder for organizations to secure internet-facing operational technology systems to prevent potential disruptions and safety hazards.
2 months ago
Kill Chain
Unveiling Fast16: The Pre-Stuxnet Cyber Sabotage Tool
In May 2026, cybersecurity researchers uncovered 'fast16,' a sophisticated Lua-based malware designed to sabotage nuclear weapons testing simulations. Developed as early as 2005, predating Stuxnet by two years, fast16 targeted engineering applications like LS-DYNA and AUTODYN to corrupt uranium-compression simulations essential for nuclear weapon design. The malware selectively tampered with high-explosive simulations, activating only when material density exceeded 30 g/cm³, a threshold indicative of uranium under implosion conditions. This strategic interference aimed to produce flawed simulation results, potentially derailing nuclear weapons development programs. The discovery of fast16 highlights the longstanding use of cyber tools for industrial sabotage by nation-state actors. Its sophisticated design and targeted approach underscore the critical need for robust cybersecurity measures in protecting sensitive research and development activities, especially those related to national security.
2 months ago
Kill Chain
Critical Vulnerability in Siemens gWAP: CVE-2026-40175
In May 2026, Siemens disclosed a critical vulnerability (CVE-2026-40175) in its gPROMS Web Applications Publisher (gWAP), stemming from the integration of a vulnerable version of the Axios HTTP client library. This flaw allows attackers to exploit prototype pollution in third-party dependencies, potentially leading to remote code execution or full cloud environment compromise. Siemens has released version 3.1.1 to address this issue and strongly recommends users update immediately. This incident underscores the risks associated with third-party software components in supply chains. Organizations must remain vigilant, ensuring all integrated libraries are up-to-date and secure to prevent similar vulnerabilities from being exploited.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports