Author: itwadmin-security

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 9.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: ValueHD, PTZOptics, multiCAM Systems, SMTAV
Equipment: Various pan-tilt-zoom cameras
Vulnerabilities: Improper Authentication, Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’), Use of Hard-coded Credentials

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following ValueHD, PTZOptics, multiCAM Systems, and SMTAV products are affected:

PTZOptics PT12X-SDI-xx-G2: Versions 6.3.34 and prior (CVE-2025-35451)
PTZOptics PT12X-NDI-xx: Versions 6.3.34 and prior (CVE-2025-35451)
PTZOptics PT12X-USB-xx-G2: Versions 6.2.81 and prior (CVE-2025-35451)
PTZOptics PT20X-SDI-xx-G2: Versions 6.3.20 and prior (CVE-2025-35451)
PTZOptics PT20X-NDI-xx: Versions 6.3.20 and prior (CVE-2025-35451)
PTZOptics PT20X-USB-xx-G2: Versions 6.2.73 and prior (CVE-2025-35451)
PTZOptics PT30X-SDI-xx-G2: Versions 6.3.30 and prior (CVE-2025-35451)
PTZOptics PT30X-NDI-xx: Versions 6.3.30 and prior (CVE-2025-35451)
PTZOptics PT12X-ZCAM: Versions 7.2.76 and prior (CVE-2025-35451)
PTZOptics PT20X-ZCAM: Versions 7.2.82 and prior (CVE-2025-35451)
PTZOptics PTVL-ZCAM: Versions 7.2.79 and prior (CVE-2025-35451)
PTZOptics PTEPTZ-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)
PTZOptics PTEPTZ-NDI-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)
PTZOptics PT12X-SDI-xx-G2: All versions (CVE-2025-35452)
PTZOptics PT12X-NDI-xx: All versions (CVE-2025-35452)
PTZOptics PT12X-USB-xx-G2: All versions (CVE-2025-35452)
PTZOptics PT20X-SDI-xx-G2: All versions (CVE-2025-35452)
PTZOpticsPT20X-NDI-xx: All versions (CVE-2025-35452)
PTZOptics PT20X-USB-xx-G2: All versions (CVE-2025-35452)
PTZOptics PT30X-SDI-xx-G2: All versions (CVE-2025-35452)
PTZOptics PT30X-NDI-xx: All versions (CVE-2025-35452)
PTZOptics PT12X-ZCAM: All versions (CVE-2025-35452)
PTZOptics PT20X-ZCAM: All versions (CVE-2025-35452)
PTZOptics PTVL-ZCAM: All versions (CVE-2025-35452)
PTZOptics PTEPTZ-ZCAM-G2: All versions (CVE-2025-35452)
PTZOptics PTEPTZ-NDI-ZCAM-G2 All versions (CVE-2025-35452)
PTZOptics PT12X-4K-xx-G3: Versions 0.0.58 and prior (CVE-2025-35452)
PTZOptics PT20X-4K-xx-G3: Versions 0.0.85 and prior (CVE-2025-35452)
PTZOptics PT30X-4K-xx-G3: Versions 2.0.64 and prior (CVE-2025-35452)
PTZOptics PT12X-LINK-4K-xx: Versions 0.0.63 and prior (CVE-2025-35452)
PTZOptics PT20X-LINK-4K-xx: Versions 0.0.89 and prior (CVE-2025-35452)
PTZOptics PT30X-LINK-4K-xx: Versions 2.0.71 and prior (CVE-2025-35452)
PTZOptics PT12X-SE-xx-G3: Versions 9.1.43 and prior (CVE-2025-35452)
PTZOptics PT20X-SE-xx-G3: Versions 9.1.32 and prior (CVE-2025-35452)
PTZOptics PT30X-SE-xx-G3: Versions 9.1.33 and prior (CVE-2025-35452)
PTZOptics PT-STUDIOPRO: Versions 9.0.41 and prior (CVE-2025-35452)
PTZOptics PTZOptics VL Fixed Camera/NDI Fixed Camera: Versions 7.2.94 and prior
SMTAV Pan-Tilt-Zoom Cameras: All versions
multiCAM Systems Pan-Tilt-Zoom Cameras: All versions
ValueHD Pan-Tilt-Zoom Cameras: All versions

3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER AUTHENTICATION CWE-287
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
CVE-2024-8956 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2024-8956. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).
3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
CVE-2024-8957 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2024-8957. A base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.3 USE OF HARD-CODED CREDENTIALS CWE-798
Certain PTZOptics and possibly other ValueHD-based cameras have SSH or telnet or both enabled by default. Operating system users with administrative privileges (including the root user) have default passwords that are trivial to crack. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
CVE-2025-35451 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-35451. A base score of 9.2 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.4 USE OF HARD-CODED CREDENTIALS CWE-798
PTZOptics and possibly other ValueHD-based cameras use a default, shared password for the administrative web interface. The table below shows the affected firmware. This has been patched on production firmware for the current generation of devices.
CVE-2025-35452 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-35452. A base score of 9.2 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Government Services and Facilities, Healthcare and Public Health
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: PTZOptics – United States; multiCAM Systems – United States; ValueHD – China; SMTAV – China

3.4 RESEARCHER
An anonymous researcher reported these vulnerabilities to CISA.
4. MITIGATIONS
PTZOptics has provided a fix to the affected versions for the listed CVEs. The fix for each product can be obtained on the PTZOptics Known Vulnerabilities and Fixes site.
ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Contact the respective companies through the following means for more information:

SMTAV Contact Us page.
multiCAM Systems Contact Us page.
ValueHD Contact Us page.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

June 12, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 9.3
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: ValueHD, PTZOptics, multiCAM Systems, SMTAV
• Equipment: Various pan-tilt-zoom cameras
• Vulnerabilities: Improper Authentication, Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’), Use of Hard-coded Credentials

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following ValueHD, PTZOptics, multiCAM Systems, and SMTAV products are affected:

• PTZOptics PT12X-SDI-xx-G2: Versions 6.3.34 and prior (CVE-2025-35451)
• PTZOptics PT12X-NDI-xx: Versions 6.3.34 and prior (CVE-2025-35451)
• PTZOptics PT12X-USB-xx-G2: Versions 6.2.81 and prior (CVE-2025-35451)
• PTZOptics PT20X-SDI-xx-G2: Versions 6.3.20 and prior (CVE-2025-35451)
• PTZOptics PT20X-NDI-xx: Versions 6.3.20 and prior (CVE-2025-35451)
• PTZOptics PT20X-USB-xx-G2: Versions 6.2.73 and prior (CVE-2025-35451)
• PTZOptics PT30X-SDI-xx-G2: Versions 6.3.30 and prior (CVE-2025-35451)
• PTZOptics PT30X-NDI-xx: Versions 6.3.30 and prior (CVE-2025-35451)
• PTZOptics PT12X-ZCAM: Versions 7.2.76 and prior (CVE-2025-35451)
• PTZOptics PT20X-ZCAM: Versions 7.2.82 and prior (CVE-2025-35451)
• PTZOptics PTVL-ZCAM: Versions 7.2.79 and prior (CVE-2025-35451)
• PTZOptics PTEPTZ-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)
• PTZOptics PTEPTZ-NDI-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)
• PTZOptics PT12X-SDI-xx-G2: All versions (CVE-2025-35452)
• PTZOptics PT12X-NDI-xx: All versions (CVE-2025-35452)
• PTZOptics PT12X-USB-xx-G2: All versions (CVE-2025-35452)
• PTZOptics PT20X-SDI-xx-G2: All versions (CVE-2025-35452)
• PTZOpticsPT20X-NDI-xx: All versions (CVE-2025-35452)
• PTZOptics PT20X-USB-xx-G2: All versions (CVE-2025-35452)
• PTZOptics PT30X-SDI-xx-G2: All versions (CVE-2025-35452)
• PTZOptics PT30X-NDI-xx: All versions (CVE-2025-35452)
• PTZOptics PT12X-ZCAM: All versions (CVE-2025-35452)
• PTZOptics PT20X-ZCAM: All versions (CVE-2025-35452)
• PTZOptics PTVL-ZCAM: All versions (CVE-2025-35452)
• PTZOptics PTEPTZ-ZCAM-G2: All versions (CVE-2025-35452)
• PTZOptics PTEPTZ-NDI-ZCAM-G2 All versions (CVE-2025-35452)
• PTZOptics PT12X-4K-xx-G3: Versions 0.0.58 and prior (CVE-2025-35452)
• PTZOptics PT20X-4K-xx-G3: Versions 0.0.85 and prior (CVE-2025-35452)
• PTZOptics PT30X-4K-xx-G3: Versions 2.0.64 and prior (CVE-2025-35452)
• PTZOptics PT12X-LINK-4K-xx: Versions 0.0.63 and prior (CVE-2025-35452)
• PTZOptics PT20X-LINK-4K-xx: Versions 0.0.89 and prior (CVE-2025-35452)
• PTZOptics PT30X-LINK-4K-xx: Versions 2.0.71 and prior (CVE-2025-35452)
• PTZOptics PT12X-SE-xx-G3: Versions 9.1.43 and prior (CVE-2025-35452)
• PTZOptics PT20X-SE-xx-G3: Versions 9.1.32 and prior (CVE-2025-35452)
• PTZOptics PT30X-SE-xx-G3: Versions 9.1.33 and prior (CVE-2025-35452)
• PTZOptics PT-STUDIOPRO: Versions 9.0.41 and prior (CVE-2025-35452)
• PTZOptics PTZOptics VL Fixed Camera/NDI Fixed Camera: Versions 7.2.94 and prior
• SMTAV Pan-Tilt-Zoom Cameras: All versions
• multiCAM Systems Pan-Tilt-Zoom Cameras: All versions
• ValueHD Pan-Tilt-Zoom Cameras: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER AUTHENTICATION CWE-287

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

CVE-2024-8956 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-8956. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

CVE-2024-8957 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-8957. A base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.3 USE OF HARD-CODED CREDENTIALS CWE-798

Certain PTZOptics and possibly other ValueHD-based cameras have SSH or telnet or both enabled by default. Operating system users with administrative privileges (including the root user) have default passwords that are trivial to crack. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.

CVE-2025-35451 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-35451. A base score of 9.2 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.4 USE OF HARD-CODED CREDENTIALS CWE-798

PTZOptics and possibly other ValueHD-based cameras use a default, shared password for the administrative web interface. The table below shows the affected firmware. This has been patched on production firmware for the current generation of devices.

CVE-2025-35452 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-35452. A base score of 9.2 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Government Services and Facilities, Healthcare and Public Health
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: PTZOptics – United States; multiCAM Systems – United States; ValueHD – China; SMTAV – China

3.4 RESEARCHER

An anonymous researcher reported these vulnerabilities to CISA.

4. MITIGATIONS

PTZOptics has provided a fix to the affected versions for the listed CVEs. The fix for each product can be obtained on the PTZOptics Known Vulnerabilities and Fixes site.

ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Contact the respective companies through the following means for more information:

• SMTAV Contact Us page.
• multiCAM Systems Contact Us page.
• ValueHD Contact Us page.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• June 12, 2025: Initial Publication

 Read More

 ​As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 7.1
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: SCALANCE and RUGGEDCOM
Vulnerabilities: Incorrect Authorization, Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to circumvent authorization checks and perform actions that exceed the permissions of the “guest” role.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00): All versions prior to V3.2
Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2): All versions prior to V3.2
Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2): All versions prior to V3.2
Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2): All versions prior to V3.2
Siemens SCALANCE XR302-32 (6GK5334-5TS00-2AR3): All versions prior to V3.2
Siemens SCALANCE XR302-32 (6GK5334-5TS00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR302-32 (6GK5334-5TS00-4AR3): All versions prior to V3.2
Siemens SCALANCE XR322-12 (6GK5334-3TS00-2AR3): All versions prior to V3.2
Siemens SCALANCE XR322-12 (6GK5334-3TS00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR322-12 (6GK5334-3TS00-4AR3): All versions prior to V3.2
Siemens SCALANCE XR326-8 (6GK5334-2TS00-2AR3): All versions prior to V3.2
Siemens SCALANCE XC316-8 (6GK5324-8TS00-2AC2): All versions prior to V3.2
Siemens SCALANCE XR326-8 (6GK5334-2TS00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR326-8 (6GK5334-2TS00-4AR3): All versions prior to V3.2
Siemens SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3): All versions prior to V3.2
Siemens SCALANCE XR502-32 (6GK5534-5TR00-2AR3): All versions prior to V3.2
Siemens SCALANCE XR502-32 (6GK5534-5TR00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR502-32 (6GK5534-5TR00-4AR3): All versions prior to V3.2
Siemens SCALANCE XR522-12 (6GK5534-3TR00-2AR3): All versions prior to V3.2
Siemens SCALANCE XR522-12 (6GK5534-3TR00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR522-12 (6GK5534-3TR00-4AR3): All versions prior to V3.2
Siemens SCALANCE XR526-8 (6GK5534-2TR00-2AR3): All versions prior to V3.2
Siemens SCALANCE XC324-4 (6GK5328-4TS00-2AC2): All versions prior to V3.2
Siemens SCALANCE XR526-8 (6GK5534-2TR00-3AR3): All versions prior to V3.2
Siemens SCALANCE XR526-8 (6GK5534-2TR00-4AR3): All versions prior to V3.2
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3): All versions prior to V3.2
Siemens SCALANCE XRM334 (2×230 V AC, 8xFO) (6GK5334-2TS01-4AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (2×230 V AC, 12xFO) (6GK5334-3TS01-4AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3): All versions prior to V3.2
Siemens SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2): All versions prior to V3.2
Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3): All versions prior to V3.2
Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3): All versions prior to V3.2
Siemens SCALANCE XC332 (6GK5332-0GA00-2AC2): All versions prior to V3.2
Siemens SCALANCE XC416-8 (6GK5424-8TR00-2AC2): All versions prior to V3.2
Siemens SCALANCE XC424-4 (6GK5428-4TR00-2AC2): All versions prior to V3.2
Siemens SCALANCE XC432 (6GK5432-0GR00-2AC2): All versions prior to V3.2
Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2): All versions prior to V3.2

3.2 VULNERABILITY OVERVIEW
3.2.1 INCORRECT AUTHORIZATION CWE-863
The “Load Rollback” functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with a “guest” role to make the affected product roll back configuration changes made by privileged users.
CVE-2025-40567 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-40567. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).
3.2.2 INCORRECT AUTHORIZATION CWE-863
An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with a “guest” role to terminate legitimate users’ sessions.
CVE-2025-40568 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
A CVSS v4 score has also been calculated for CVE-2025-40568. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).
3.2.3 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER SYNCHRONIZATION (‘RACE CONDITION’) CWE-362
The “Load Configuration from Local PC” functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.
CVE-2025-40569 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-40569. A base score of 5.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER
Siemens reported these vulnerabilities to CISA.
4. MITIGATIONS
Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

RUGGEDCOM RST2428P (6GK6242-6PA00), SCALANCE XC316-8 (6GK5324-8TS00-2AC2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2), SCALANCE XC332 (6GK5332-0GA00-2AC2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2), SCALANCE XC424-4 (6GK5428-4TR00-2AC2), SCALANCE XC432 (6GK5432-0GR00-2AC2), SCALANCE XCH328 (6GK5328-4TS01-2EC2), SCALANCE XCM324 (6GK5324-8TS01-2AC2), SCALANCE XCM328 (6GK5328-4TS01-2AC2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3), SCALANCE XR302-32 (6GK5334-5TS00-3AR3), SCALANCE XR302-32 (6GK5334-5TS00-4AR3), SCALANCE XR322-12 (6GK5334-3TS00-2AR3), SCALANCE XR322-12 (6GK5334-3TS00-3AR3), SCALANCE XR322-12 (6GK5334-3TS00-4AR3), SCALANCE XR326-8 (6GK5334-2TS00-2AR3), SCALANCE XR326-8 (6GK5334-2TS00-3AR3), SCALANCE XR326-8 (6GK5334-2TS00-4AR3), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3), SCALANCE XR502-32 (6GK5534-5TR00-2AR3), SCALANCE XR502-32 (6GK5534-5TR00-3AR3), SCALANCE XR502-32 (6GK5534-5TR00-4AR3), SCALANCE XR522-12 (6GK5534-3TR00-2AR3), SCALANCE XR522-12 (6GK5534-3TR00-3AR3), SCALANCE XR522-12 (6GK5534-3TR00-4AR3), SCALANCE XR526-8 (6GK5534-2TR00-2AR3), SCALANCE XR526-8 (6GK5534-2TR00-3AR3), SCALANCE XR526-8 (6GK5534-2TR00-4AR3), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3), SCALANCE XRM334 (2×230 V AC, 8xFO) (6GK5334-2TS01-4AR3), SCALANCE XRM334 (2×230 V AC, 12xFO) (6GK5334-3TS01-4AR3), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3): Update to V3.2 or later version
SCALANCE XCM332 (6GK5332-0GA01-2AC2): Update to V3.2 or later version

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.
Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage
For more information see the associated Siemens security advisory SSA-693776 in HTML and CSAF.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

June 12, 2025: Initial Publication 

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 7.1
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Siemens
• Equipment: SCALANCE and RUGGEDCOM
• Vulnerabilities: Incorrect Authorization, Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to circumvent authorization checks and perform actions that exceed the permissions of the “guest” role.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

• Siemens RUGGEDCOM RST2428P (6GK6242-6PA00): All versions prior to V3.2
• Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2): All versions prior to V3.2
• Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2): All versions prior to V3.2
• Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2): All versions prior to V3.2
• Siemens SCALANCE XR302-32 (6GK5334-5TS00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XR302-32 (6GK5334-5TS00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR302-32 (6GK5334-5TS00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XR322-12 (6GK5334-3TS00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XR322-12 (6GK5334-3TS00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR322-12 (6GK5334-3TS00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XR326-8 (6GK5334-2TS00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XC316-8 (6GK5324-8TS00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XR326-8 (6GK5334-2TS00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR326-8 (6GK5334-2TS00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3): All versions prior to V3.2
• Siemens SCALANCE XR502-32 (6GK5534-5TR00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XR502-32 (6GK5534-5TR00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR502-32 (6GK5534-5TR00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XR522-12 (6GK5534-3TR00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XR522-12 (6GK5534-3TR00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR522-12 (6GK5534-3TR00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XR526-8 (6GK5534-2TR00-2AR3): All versions prior to V3.2
• Siemens SCALANCE XC324-4 (6GK5328-4TS00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XR526-8 (6GK5534-2TR00-3AR3): All versions prior to V3.2
• Siemens SCALANCE XR526-8 (6GK5534-2TR00-4AR3): All versions prior to V3.2
• Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (2×230 V AC, 8xFO) (6GK5334-2TS01-4AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (2×230 V AC, 12xFO) (6GK5334-3TS01-4AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3): All versions prior to V3.2
• Siemens SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2): All versions prior to V3.2
• Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3): All versions prior to V3.2
• Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3): All versions prior to V3.2
• Siemens SCALANCE XC332 (6GK5332-0GA00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XC416-8 (6GK5424-8TR00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XC424-4 (6GK5428-4TR00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XC432 (6GK5432-0GR00-2AC2): All versions prior to V3.2
• Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2): All versions prior to V3.2

3.2 VULNERABILITY OVERVIEW

3.2.1 INCORRECT AUTHORIZATION CWE-863

The “Load Rollback” functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with a “guest” role to make the affected product roll back configuration changes made by privileged users.

CVE-2025-40567 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2025-40567. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).

3.2.2 INCORRECT AUTHORIZATION CWE-863

An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with a “guest” role to terminate legitimate users’ sessions.

CVE-2025-40568 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

A CVSS v4 score has also been calculated for CVE-2025-40568. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).

3.2.3 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER SYNCHRONIZATION (‘RACE CONDITION’) CWE-362

The “Load Configuration from Local PC” functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.

CVE-2025-40569 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2025-40569. A base score of 5.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

• RUGGEDCOM RST2428P (6GK6242-6PA00), SCALANCE XC316-8 (6GK5324-8TS00-2AC2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2), SCALANCE XC332 (6GK5332-0GA00-2AC2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2), SCALANCE XC424-4 (6GK5428-4TR00-2AC2), SCALANCE XC432 (6GK5432-0GR00-2AC2), SCALANCE XCH328 (6GK5328-4TS01-2EC2), SCALANCE XCM324 (6GK5324-8TS01-2AC2), SCALANCE XCM328 (6GK5328-4TS01-2AC2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3), SCALANCE XR302-32 (6GK5334-5TS00-3AR3), SCALANCE XR302-32 (6GK5334-5TS00-4AR3), SCALANCE XR322-12 (6GK5334-3TS00-2AR3), SCALANCE XR322-12 (6GK5334-3TS00-3AR3), SCALANCE XR322-12 (6GK5334-3TS00-4AR3), SCALANCE XR326-8 (6GK5334-2TS00-2AR3), SCALANCE XR326-8 (6GK5334-2TS00-3AR3), SCALANCE XR326-8 (6GK5334-2TS00-4AR3), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3), SCALANCE XR502-32 (6GK5534-5TR00-2AR3), SCALANCE XR502-32 (6GK5534-5TR00-3AR3), SCALANCE XR502-32 (6GK5534-5TR00-4AR3), SCALANCE XR522-12 (6GK5534-3TR00-2AR3), SCALANCE XR522-12 (6GK5534-3TR00-3AR3), SCALANCE XR522-12 (6GK5534-3TR00-4AR3), SCALANCE XR526-8 (6GK5534-2TR00-2AR3), SCALANCE XR526-8 (6GK5534-2TR00-3AR3), SCALANCE XR526-8 (6GK5534-2TR00-4AR3), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3), SCALANCE XRM334 (2×230 V AC, 8xFO) (6GK5334-2TS01-4AR3), SCALANCE XRM334 (2×230 V AC, 12xFO) (6GK5334-3TS01-4AR3), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3): Update to V3.2 or later version
• SCALANCE XCM332 (6GK5332-0GA01-2AC2): Update to V3.2 or later version

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-693776 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• June 12, 2025: Initial Publication

 Read More

 ​As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 9.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: Energy Services
Vulnerability: Incorrect Default Permissions

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to gain remote control of the G5DFR component and tamper outputs from the device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:

Energy Services: All versions

3.2 VULNERABILITY OVERVIEW
3.2.1 INCORRECT DEFAULT PERMISSIONS CWE-276
Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.
CVE-2025-40585 has been assigned to this vulnerability. A CVSS v3 base score of 9.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).
A CVSS v4 score has also been calculated for CVE-2025-40585. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER
Siemens reported this vulnerability to CISA.
4. MITIGATIONS
Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

Use the G5DFR web interface to change the default usernames, passwords and permission levels. Contact customer support for further assistance

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.
Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage
For more information see the associated Siemens security advisory SSA-345750 in HTML and CSAF.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

June 12, 2025: Initial Republication of Siemens SSA-345750 

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 9.5
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Siemens
• Equipment: Energy Services
• Vulnerability: Incorrect Default Permissions

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to gain remote control of the G5DFR component and tamper outputs from the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

• Energy Services: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 INCORRECT DEFAULT PERMISSIONS CWE-276

Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.

CVE-2025-40585 has been assigned to this vulnerability. A CVSS v3 base score of 9.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).

A CVSS v4 score has also been calculated for CVE-2025-40585. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Use the G5DFR web interface to change the default usernames, passwords and permission levels. Contact customer support for further assistance

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-345750 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• June 12, 2025: Initial Republication of Siemens SSA-345750

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 4.5
ATTENTION: Exploitable remotely
Vendor: AVEVA
Equipment: PI Web API
Vulnerability: Cross-site Scripting

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to disable content security policy protections.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of AVEVA PI Web API are affected:

PI Web API: Versions 2023 SP1 and prior

3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
A cross-site scripting vulnerability exists in PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.
CVE-2025-2745 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
A CVSS v4 score has also been calculated for CVE-2025-2745. A base score of 4.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United Kingdom

3.4 RESEARCHER
AVEVA Ethical Disclosure reported this vulnerability to CISA.
4. MITIGATIONS
AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit.
From OSISoft Customer Portal, search for “PI Web API” and select version 2023 SP1 Patch 1 or higher.
AVEVA further recommends users follow general defensive measures:

Review and update the file extensions allowlist for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, …).
Consider implementing IT policies that would prevent users from subverting/disabling content security policy browser protections.
Inform PI Web API users that annotation attachments should be retrieved through direct REST requests to PI Web API rather than rendering them in the browser interface.
Audit assigned privileges to ensure that only trusted users are given “Annotate” access rights.

For additional information please refer to AVEVA-2025-003.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
5. UPDATE HISTORY

June 12, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 4.5
• ATTENTION: Exploitable remotely
• Vendor: AVEVA
• Equipment: PI Web API
• Vulnerability: Cross-site Scripting

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to disable content security policy protections.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of AVEVA PI Web API are affected:

• PI Web API: Versions 2023 SP1 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79

A cross-site scripting vulnerability exists in PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.

CVE-2025-2745 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2025-2745. A base score of 4.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: United Kingdom

3.4 RESEARCHER

AVEVA Ethical Disclosure reported this vulnerability to CISA.

4. MITIGATIONS

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit.

From OSISoft Customer Portal, search for “PI Web API” and select version 2023 SP1 Patch 1 or higher.

AVEVA further recommends users follow general defensive measures:

• Review and update the file extensions allowlist for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, …).
• Consider implementing IT policies that would prevent users from subverting/disabling content security policy browser protections.
• Inform PI Web API users that annotation attachments should be retrieved through direct REST requests to PI Web API rather than rendering them in the browser interface.
• Audit assigned privileges to ensure that only trusted users are given “Annotate” access rights.

For additional information please refer to AVEVA-2025-003.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• June 12, 2025: Initial Publication

 Read More

​Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.  

Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.

The sole zero-day flaw this month is CVE-2025-33053, a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn’t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said Seth Hoyt, senior security engineer at Automox.

Adam Barnett, lead software engineer at Rapid7, said Microsoft’s advisory for CVE-2025-33053 does not mention that the Windows implementation of WebDAV is listed as deprecated since November 2023, which in practical terms means that the WebClient service no longer starts by default.

“The advisory also has attack complexity as low, which means that exploitation does not require preparation of the target environment in any way that is beyond the attacker’s control,” Barnett said. “Exploitation relies on the user clicking a malicious link. It’s not clear how an asset would be immediately vulnerable if the service isn’t running, but all versions of Windows receive a patch, including those released since the deprecation of WebClient, like Server 2025 and Windows 11 24H2.”

Microsoft warns that an “elevation of privilege” vulnerability in the Windows Server Message Block (SMB) client (CVE-2025-33073) is likely to be exploited, given that proof-of-concept code for this bug is now public. CVE-2025-33073 has a CVSS risk score of 8.8 (out of 10), and exploitation of the flaw leads to the attacker gaining “SYSTEM” level control over a vulnerable PC.

“What makes this especially dangerous is that no further user interaction is required after the initial connection—something attackers can often trigger without the user realizing it,” said Alex Vovk, co-founder and CEO of Action1. “Given the high privilege level and ease of exploitation, this flaw poses a significant risk to Windows environments. The scope of affected systems is extensive, as SMB is a core Windows protocol used for file and printer sharing and inter-process communication.”

Beyond these highlights, 10 of the vulnerabilities fixed this month were rated “critical” by Microsoft, including eight remote code execution flaws.

Notably absent from this month’s patch batch is a fix for a newly discovered weakness in Windows Server 2025 that allows attackers to act with the privileges of any user in Active Directory. The bug, dubbed “BadSuccessor,” was publicly disclosed by researchers at Akamai on May 21, and several public proof-of-concepts are now available. Tenable’s Satnam Narang said organizations that have at least one Windows Server 2025 domain controller should review permissions for principals and limit those permissions as much as possible.

Adobe has released updates for Acrobat Reader and six other products addressing at least 259 vulnerabilities, most of them in an update for Experience Manager. Mozilla Firefox and Google Chrome both recently released security updates that require a restart of the browser to take effect. The latest Chrome update fixes two zero-day exploits in the browser (CVE-2025-5419 and CVE-2025-4664).

For a detailed breakdown on the individual security updates released by Microsoft today, check out the Patch Tuesday roundup from the SANS Internet Storm Center. Action 1 has a breakdown of patches from Microsoft and a raft of other software vendors releasing fixes this month. As always, please back up your system and/or data before patching, and feel free to drop a note in the comments if you run into any problems applying these updates.

 

​Read More

 ​CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

CVE-2025-24016 Wazuh Server Deserialization of Untrusted Data Vulnerability

CVE-2025-33053 Web Distributed Authoring and Versioning (WebDAV) External Control of File Name or Path Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. 

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.  

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.8
ATTENTION: Exploitable remotely/Low attack complexity
Vendor: SinoTrack
Equipment: All Known SinoTrack Devices
Vulnerabilities: Weak Authentication, Observable Response Discrepency

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface. Access to the device profile may allow an attacker to perform some remote functions on connected vehicles such as tracking the vehicle location and disconnecting power to the fuel pump where supported.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following SinoTrack products are affected:

SinoTrack IOT PC Platform: All versions

3.2 VULNERABILITY OVERVIEW
3.2.1 WEAK AUTHENTICATION CWE-1390
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.
CVE-2025-5484 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).
A CVSS v4 score has also been calculated for CVE-2025-5484. A base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L).
3.2.2 OBSERVABLE RESPONSE DISCREPENCY CWE-204
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences.
CVE-2025-5485 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
A CVSS v4 score has also been calculated for CVE-2025-5485. A base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:L).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Communications
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: China

3.4 RESEARCHER
Independent researcher Raúl Ignacio Cruz Jiménez reported these vulnerabilities to CISA.
4. MITIGATIONS
SinoTrack did not respond to CISA’s request for coordination. Please contact SinoTrack for more information.
CISA recommends that device users take defensive measures to minimize the risk of exploitation of these vulnerabilities, including:

Change the default password to a unique, complex password as soon as is practical in the management interface available at https://sinotrack.com/.
Conceal the device identifier. If the sticker is visible on publicly accessible photographs, consider deleting or replacing the pictures to protect the identifier.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

June 10, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.8
• ATTENTION: Exploitable remotely/Low attack complexity
• Vendor: SinoTrack
• Equipment: All Known SinoTrack Devices
• Vulnerabilities: Weak Authentication, Observable Response Discrepency

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface. Access to the device profile may allow an attacker to perform some remote functions on connected vehicles such as tracking the vehicle location and disconnecting power to the fuel pump where supported.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following SinoTrack products are affected:

• SinoTrack IOT PC Platform: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 WEAK AUTHENTICATION CWE-1390

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.

CVE-2025-5484 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).

A CVSS v4 score has also been calculated for CVE-2025-5484. A base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L).

3.2.2 OBSERVABLE RESPONSE DISCREPENCY CWE-204

User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences.

CVE-2025-5485 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

A CVSS v4 score has also been calculated for CVE-2025-5485. A base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:L).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Communications
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: China

3.4 RESEARCHER

Independent researcher Raúl Ignacio Cruz Jiménez reported these vulnerabilities to CISA.

4. MITIGATIONS

SinoTrack did not respond to CISA’s request for coordination. Please contact SinoTrack for more information.

CISA recommends that device users take defensive measures to minimize the risk of exploitation of these vulnerabilities, including:

• Change the default password to a unique, complex password as soon as is practical in the management interface available at https://sinotrack.com/.
• Conceal the device identifier. If the sticker is visible on publicly accessible photographs, consider deleting or replacing the pictures to protect the identifier.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• June 10, 2025: Initial Publication

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.6
ATTENTION: Exploitable remotely/low attack complexity
Vendor: MicroDicom
Equipment: DICOM Viewer
Vulnerability: Out-of-bounds Write

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following MicroDicom products are affected:

DICOM Viewer: Versions 2025.2 (Build 8154) and prior

3.2 VULNERABILITY OVERVIEW
3.2.1 OUT-OF-BOUNDS WRITE CWE-787
DICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally.
CVE-2025-5943 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-5943. A base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Bulgaria

3.4 RESEARCHER
Michael Heinzl reported this vulnerability to CISA.
4. MITIGATIONS
MicroDicom recommends users update DICOM Viewer to version 2025.3 or later.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

June 10, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.6
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: MicroDicom
• Equipment: DICOM Viewer
• Vulnerability: Out-of-bounds Write

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following MicroDicom products are affected:

• DICOM Viewer: Versions 2025.2 (Build 8154) and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 OUT-OF-BOUNDS WRITE CWE-787

DICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally.

CVE-2025-5943 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-5943. A base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Bulgaria

3.4 RESEARCHER

Michael Heinzl reported this vulnerability to CISA.

4. MITIGATIONS

MicroDicom recommends users update DICOM Viewer to version 2025.3 or later.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• June 10, 2025: Initial Publication

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.2
ATTENTION: Exploitable remotely
Vendor: Hitachi Energy
Equipment: Relion 670, 650, SAM600-IO Series
Vulnerability: Observable Discrepancy

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to decrypt application data in transit.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Hitachi Energy reports that the following products are affected:

Relion 670: Version 2.2.0
Relion 670: Version 2.2.1
Relion 650: Version 2.2.0
Relion 650: Version 2.2.1
Relion 670: Versions 2.2.2.0 through 2.2.2.5
Relion 670: Versions 2.2.3.0 through 2.2.3.6
Relion 670: Versions 2.2.4.0 through 2.2.4.3
Relion 650: Versions 2.2.4.0 through 2.2.4.3
Relion 670: Versions 2.2.5.0 through 2.2.5.5
Relion 650: Versions 2.2.5.0 through 2.2.5.5
SAM600-IO: Version 2.2.1
SAM600-IO: Versions from 2.2.5.0 up to but not including, 2.2.5.5

3.2 VULNERABILITY OVERVIEW
3.2.1 OBSERVABLE DISCREPANCY CWE-203
A timing-based side channel exists in the OpenSSL RSA decryption implementation, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve a successful decryption, an attacker would have to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
CVE-2022-4304 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2022-4304. A base score of 8.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER
Hitachi Energy reported this vulnerability to CISA.
4. MITIGATIONS
Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

Relion 670 series version 2.2.0: Apply general mitigation factors.
Relion 670 series version 2.2.1: Apply general mitigation factors.
Relion 650 series version 2.2.0: Apply general mitigation factors.
Relion 650 series version 2.2.1: Apply general mitigation factors.
Relion 670 series version 2.2.2 through 2.2.2.5: Update to version 2.2.2.6 or latest.
Relion 670 series version 2.2.3 through 2.2.3.6: Update to version 2.2.3.7 or latest.
Relion 670 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
Relion 650 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
Relion 670 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
Relion 650 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
SAM600-IO series version 2.2.1: Apply general mitigation factors.
SAM600-IO series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.

For more information, see the associated Hitachi Energy PSIRT Security Advisory 8DBD000157.
Hitachi Energy recommends the following general mitigation factors and security practices:

Configure firewalls to protect process control networks from attacks originating from outside the network.
Physically protect process control systems from direct access by unauthorized personnel.
Avoid directly connecting control systems to the internet.
Separate process control networks from other networks via a firewall system with minimal exposed ports.
Users should not use process control systems for internet surfing, instant messaging, or email.
Portable computers and removable storage media should be carefully scanned for viruses before connecting to a control system.
Enforce proper password policies and processes.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
5. UPDATE HISTORY

June 10, 2025: Initial Republication of Hitachi Energy’s 8DBD000157. 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.2
• ATTENTION: Exploitable remotely
• Vendor: Hitachi Energy
• Equipment: Relion 670, 650, SAM600-IO Series
• Vulnerability: Observable Discrepancy

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to decrypt application data in transit.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Hitachi Energy reports that the following products are affected:

• Relion 670: Version 2.2.0
• Relion 670: Version 2.2.1
• Relion 650: Version 2.2.0
• Relion 650: Version 2.2.1
• Relion 670: Versions 2.2.2.0 through 2.2.2.5
• Relion 670: Versions 2.2.3.0 through 2.2.3.6
• Relion 670: Versions 2.2.4.0 through 2.2.4.3
• Relion 650: Versions 2.2.4.0 through 2.2.4.3
• Relion 670: Versions 2.2.5.0 through 2.2.5.5
• Relion 650: Versions 2.2.5.0 through 2.2.5.5
• SAM600-IO: Version 2.2.1
• SAM600-IO: Versions from 2.2.5.0 up to but not including, 2.2.5.5

3.2 VULNERABILITY OVERVIEW

3.2.1 OBSERVABLE DISCREPANCY CWE-203

A timing-based side channel exists in the OpenSSL RSA decryption implementation, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve a successful decryption, an attacker would have to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

CVE-2022-4304 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2022-4304. A base score of 8.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Hitachi Energy reported this vulnerability to CISA.

4. MITIGATIONS

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Relion 670 series version 2.2.0: Apply general mitigation factors.
• Relion 670 series version 2.2.1: Apply general mitigation factors.
• Relion 650 series version 2.2.0: Apply general mitigation factors.
• Relion 650 series version 2.2.1: Apply general mitigation factors.
• Relion 670 series version 2.2.2 through 2.2.2.5: Update to version 2.2.2.6 or latest.
• Relion 670 series version 2.2.3 through 2.2.3.6: Update to version 2.2.3.7 or latest.
• Relion 670 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
• Relion 650 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
• Relion 670 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
• Relion 650 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
• SAM600-IO series version 2.2.1: Apply general mitigation factors.
• SAM600-IO series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.

For more information, see the associated Hitachi Energy PSIRT Security Advisory 8DBD000157.

Hitachi Energy recommends the following general mitigation factors and security practices:

• Configure firewalls to protect process control networks from attacks originating from outside the network.
• Physically protect process control systems from direct access by unauthorized personnel.
• Avoid directly connecting control systems to the internet.
• Separate process control networks from other networks via a firewall system with minimal exposed ports.
• Users should not use process control systems for internet surfing, instant messaging, or email.
• Portable computers and removable storage media should be carefully scanned for viruses before connecting to a control system.
• Enforce proper password policies and processes.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

5. UPDATE HISTORY

• June 10, 2025: Initial Republication of Hitachi Energy’s 8DBD000157.

 Read More

 ​CISA released four Industrial Control Systems (ICS) advisories on June 10, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

ICSA-25-160-01 SinoTrack GPS Receiver
ICSA-25-160-02 Hitachi Energy Relion 670, 650, SAM600-IO Series 
ICSMA-25-160-01 MicroDicom DICOM Viewer 
ICSA-25-140-11 Assured Telematics Inc (ATI) Fleet Management System (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations. 

CISA released four Industrial Control Systems (ICS) advisories on June 10, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• ICSA-25-160-01 SinoTrack GPS Receiver
• ICSA-25-160-02 Hitachi Energy Relion 670, 650, SAM600-IO Series
   
• ICSMA-25-160-01 MicroDicom DICOM Viewer
   
• ICSA-25-140-11 Assured Telematics Inc (ATI) Fleet Management System (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

 Read More