CISA Releases Thirteen Industrial Control Systems Focusing Vulnerabilities & Exploits

An improper output neutralization for logs vulnerability CVE-2024-5594 in Siemens SINEMA Remote Connect Server.  It allows a malicious OpenVPN peer to send garbage to the OpenVPN log or cause high CPU load. The advisory includes missing authentication for critical functions and improper input validation vulnerabilities tracked as CVE-2024-52285, CVE-2025-27493, and CVE-2025-27494. Exploiting these vulnerabilities could allow an unauthorized attacker to read or delete arbitrary files or the entire device file system. The vulnerabilities could allow an attacker to bypass application authentication and gain access to the data managed by the server. Similar to CVE-2025-23397, this vulnerability also relates to improper memory buffer operations tracked as CVE-2025-23398. Successful exploitation of this vulnerability could allow an attacker to obtain partial invalid usernames accepted by the server. The issues could allow remote attackers to intercept sensitive communications, gain unauthorized access, and potentially execute arbitrary code. Successful exploitation of this vulnerability could allow an attacker to download untrusted firmware that could damage or compromise the device. Another memory buffer restriction vulnerability, CVE-2025-23400, affects the same applications and enables memory corruption during specially crafted WRL file parsing. Successful exploitation of these vulnerabilities could allow an authenticated attacker to alter the secure boot configuration or to disable the BIOS password. The advisory includes vulnerabilities such as CVE-2025-2230 and CVE-2025-2229 that could allow privilege escalation and arbitrary code execution. This vulnerability could allow attackers to execute arbitrary code in the context of the current process. A NULL pointer dereference vulnerability CVE-2024-41055 in the Linux kernel’s memory management subsystem.  This could result in denial-of-service conditions. It could allow an attacker to execute commands on the device with root privileges and access sensitive data. The advisory includes Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection‘), which is tracked as CVE-2025-27392, CVE-2025-27393, CVE-2025-27398, and CVE-2025-27394. An Improper Authentication vulnerability was tracked as CVE-2024-56336. The vulnerabilities include observable timing discrepancy tracked as CVE-2024-42512 and authentication bypass by primary weakness tracked as CVE-2024-42513. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. It allows memory corruption through malicious WRL file parsing that could lead to unauthorized code execution. The significant number of vulnerabilities across major industrial systems highlights the ongoing challenge of securing increasingly connected operational technology environments against evolving cyber threats. An out-of-bounds write vulnerability in Siemens Teamcenter Visualization and Tecnomatix Plant Simulation CVE-2025-23396 occurs when parsing specially crafted WRL files. Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) CVE-2025-27395, CVE-2025-27397 and Improper Check for Dropped Privileges tracked as CVE-2025-27396. These vulnerabilities range from improper certificate validation to authorization bypasses and buffer overflows. An improper restriction of operations within memory buffer bounds CVE-2025-23397 in the affected applications. A remote attacker would need access to a valid certificate in order to perform a successful attack. An integer overflow vulnerability CVE-2024-1305 in the tap-windows6 driver (version 9.26 and earlier) is used in the SINEMA Remote Connect Client. A use-after-free vulnerability CVE-2024-41049 in the Linux kernel’s file locking mechanism. Partial String Comparison vulnerability is tracked as CVE-2025-23384.

This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Mar 2025 10:10:07 +0000


Cyber News related to CISA Releases Thirteen Industrial Control Systems Focusing Vulnerabilities & Exploits

CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
9 months ago Securityaffairs.com
CVE-2021-36845 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions < 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. ...
3 years ago
CISA pledges to resolve issues with threat sharing system after watchdog report - On Friday, the Department of Homeland Security’s Office of the Inspector General published a report on Automated Indicator Sharing (AIS) — which was used to spread cyber threat intelligence and was mandated as part of a 2015 law. The nation’s ...
5 months ago Therecord.media
CISA's OT Attack Response Team Understaffed: GAO - The US Government Accountability Office has conducted a study focusing on the operational technology cybersecurity products and services offered by CISA and found that some of the security agency's teams are understaffed. OT environments continue to ...
1 year ago Securityweek.com
Ethercat Zeek Plugin - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow remote code execution. Industrial Control Systems Network Protocol Parsers - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their ...
1 year ago Cisa.gov CVE-2023-7244 CVE-2023-7243 CVE-2023-7242
Siemens SCALANCE and RUGGEDCOM M-800/S615 Family - As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT ...
1 year ago Cisa.gov CVE-2023-44317 CVE-2023-49692
IT and OT cybersecurity: A holistic approach - In comparison, OT refers to the specialized systems that control physical processes and industrial operations. OT Technologies include industrial control systems, SCADA systems and programmable logic controllers that directly control physical ...
1 year ago Securityintelligence.com
Rockwell Automation FactoryTalk Activation - RISK EVALUATION. Successful exploitation of these vulnerabilities could result in a buffer overflow and allow the attacker to gain full access to the system. Rockwell Automation FactoryTalk Activation Manager and Studio 5000 Logix Designer uses the ...
1 year ago Cisa.gov CVE-2023-38545 CVE-2023-3935
Recapping Cisco industrial IoT's journey: A year of security, simplification and innovation - In this blog, we'll take a look back at the key topics and trends that defined the industrial IoT journey in 2023. Empowering our industrial customers to digitize and secure operations at the same time has been prevalent in every conversation this ...
1 year ago Feedpress.me
EuroTel ETL3100 Radio Transmitter - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain full access to the system, disclose sensitive information, or access hidden resources. EuroTel ETL3100 versions v01c01 and v01x37 does ...
1 year ago Cisa.gov CVE-2023-6928 CVE-2023-6929 CVE-2023-6930
Enabling Threat-Informed Cybersecurity: Evolving CISA's Approach to Cyber Threat Information Sharing - One of CISA's most important and enduring roles is providing timely and actionable cybersecurity information to our partners across the country. Nearly a decade ago, CISA stood up our Automated Indicator Sharing, or AIS, program to widely exchange ...
1 year ago Cisa.gov
CISA confirms compromise of its Ivanti systems - CISA confirmed two of its internal systems were breached by a threat actor that exploited flaws in Ivanti products used by the U.S. cybersecurity agency. Ivanti on Jan. 10 disclosed two zero-day vulnerabilities that were under exploitation by a ...
1 year ago Techtarget.com CVE-2023-46805 CVE-2024-21887
Optigo Networks ONS-S8 Spectra Aggregation Switch | CISA - CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial ...
5 months ago Cisa.gov CVE-2024-41925 CVE-2024-45367
CISA orders federal agencies to patch Looney Tunables Linux bug - Today, CISA ordered U.S. federal agencies to secure their systems against an actively exploited vulnerability that lets attackers gain root privileges on many major Linux distributions. Dubbed 'Looney Tunables' by Qualys' Threat Research Unit and ...
1 year ago Bleepingcomputer.com CVE-2023-4911 CVE-2023-46604
Cybersecurity Performance Goals: Assessing How CPGs Help Organizations Reduce Cyber Risk - In October 2022, CISA released the Cybersecurity Performance Goals to help organizations of all sizes and at all levels of cyber maturity become confident in their cybersecurity posture and reduce business risk. Earlier this summer, CISA outlined ...
1 year ago Cisa.gov
Delta Electronics InfraSuite Device Master - RISK EVALUATION. Successful exploitation of this vulnerability could allow remote code execution. Delta Electronics InfraSuite Device Master contains a deserialization of untrusted data vulnerability because it runs a version of Apache ActiveMQ which ...
10 months ago Cisa.gov CVE-2023-46604
Franklin Electric Fueling Systems Colibri - RISK EVALUATION. Successful exploitation of this vulnerability could allow an attacker to obtain login credentials for other users. The discontinued FFS Colibri product allows a remote user to access files on the system including files containing ...
1 year ago Cisa.gov CVE-2023-5885
Commend WS203VICM - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information or force the system to restart. A remote, unauthenticated attacker may be able to send crafted messages to the web server of the ...
1 year ago Cisa.gov CVE-2024-22182 CVE-2024-21767 CVE-2024-23492
Mitsubishi Electric FA Engineering Software Products - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow a malicious attacker to disclose information in the affected products. For the correspondence table of the affected products and each vulnerability, refer to Mitsubishi ...
1 year ago Cisa.gov CVE-2022-21151 CVE-2021-33149
Securing Tomorrow: A Recap of CISA's Cyber Resilient 911 Symposium - CISA's Emergency Communications Division spearheaded the Cyber Resilient 911 Program's fourth regional symposium, which included CISA Regions 5 and 7. Among the attendees were state 911 administrators, representatives from 911 centers, IT/cyber ...
9 months ago Cisa.gov
PTC KEPServerEx - EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity. RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an attacker gaining Windows SYSTEM-level code execution on the service host and may ...
1 year ago Cisa.gov CVE-2023-5908 CVE-2023-5909
Delta Electronics InfraSuite Device Master - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an attacker to remotely execute arbitrary code and obtain plaintext credentials. In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows ...
1 year ago Cisa.gov CVE-2023-46690 CVE-2023-47207 CVE-2023-39226 CVE-2023-47279
Fuji Electric Tellus Lite V-Simulator - RISK EVALUATION. Successful exploitation of these vulnerabilities could crash the device being accessed, allow remote code execution, or overwrite files. Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a ...
1 year ago Cisa.gov CVE-2023-35127 CVE-2023-40152 CVE-2023-5299
EFACEC BCU 500 - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product or compromise the web application through a cross-site request forgery vulnerability. Through the ...
1 year ago Cisa.gov CVE-2023-50707 CVE-2023-6689
Rockwell Automation FactoryTalk Historian SE - RISK EVALUATION. Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. FactoryTalk Historian SE utilizes the AVEVA PI Server, which contains a vulnerability that could allow an ...
10 months ago Cisa.gov CVE-2023-31274 CVE-2023-34348

Cyber Trends (last 7 days)