The Cybersecurity and Infrastructure Security Agency (CISA) released five Industrial Control Systems (ICS) advisories on March 20, 2025, providing critical information about security vulnerabilities affecting industrial control systems across multiple vendors. CVE-2025-2480 designates an out-of-bounds write vulnerability, a critical security flaw that can lead to memory corruption and potential code execution. Consequently, any system running these versions is at risk and should be updated to a patched version to prevent potential exploitation of this out-of-bounds write vulnerability. Industrial control systems often support critical infrastructure, making these vulnerabilities potential targets for threat actors seeking to disrupt essential services. Therefore, users operating any of these earlier versions are at risk and should update to the patched version as soon as possible to mitigate the potential exploitation of this vulnerability. This vulnerability has been assigned a CVSS v4 base score of 8.4, indicating a high severity. The affected versions are 14.1.2 and all prior releases. Users of older versions of Siemens Simcenter Femap are strongly advised to update to a patched version to mitigate the risk posed by this vulnerability. These vulnerabilities collectively highlight potential weaknesses in the handling of network traffic, where inadequate validation of incoming packets could lead to security breaches. This security flaw has been assigned a CVSS v4 base score of 8.5, indicating a high severity. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Organizations using the affected products should promptly evaluate their exposure, prioritize patching based on risk assessment, and implement required mitigations to prevent exploitation of these vulnerabilities. The vulnerability has been assigned a CVSS v4 base score of 6.9, indicating a significant level of concern. Earlier this month, CISA released seven ICS advisories on March 18, 2025, and thirteen advisories on March 13, 2025, highlighting the agency’s commitment to securing critical infrastructure.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Mar 2025 07:05:17 +0000