Category: CISA Alerts

 ​CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-20281 Cisco Identity Services Engine Injection Vulnerability
CVE-2025-20337 Cisco Identity Services Engine Injection Vulnerability
CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-20281 Cisco Identity Services Engine Injection Vulnerability
• CVE-2025-20337 Cisco Identity Services Engine Injection Vulnerability
• CVE-2023-2533 PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.3
ATTENTION: Exploitable remotely
Vendor: LG Innotek
Equipment: Camera Model LNV5110R
Vulnerability: Authentication Bypass Using an Alternate Path or Channel

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to gain administrative access to the device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following model of LG Innotek CCTV Camera is affected:

LNV5110R: All versions

3.2 Vulnerability Overview
3.2.1 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target device at the administrator privilege level.
CVE-2025-7742 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
A CVSS v4 score has also been calculated for CVE-2025-7742. A base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: South Korea

3.4 RESEARCHER
Souvik Kandar reported this vulnerability to CISA.
4. MITIGATIONS
LG Innotek is aware of the vulnerability but has noted this is an end-of-life product that can no longer be patched.
Please visit the LG Security Center for further guidance.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
5. UPDATE HISTORY

July 24, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.3
• ATTENTION: Exploitable remotely
• Vendor: LG Innotek
• Equipment: Camera Model LNV5110R
• Vulnerability: Authentication Bypass Using an Alternate Path or Channel

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to gain administrative access to the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following model of LG Innotek CCTV Camera is affected:

• LNV5110R: All versions

3.2 Vulnerability Overview

3.2.1 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target device at the administrator privilege level.

CVE-2025-7742 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

A CVSS v4 score has also been calculated for CVE-2025-7742. A base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: South Korea

3.4 RESEARCHER

Souvik Kandar reported this vulnerability to CISA.

4. MITIGATIONS

LG Innotek is aware of the vulnerability but has noted this is an end-of-life product that can no longer be patched.

Please visit the LG Security Center for further guidance.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• July 24, 2025: Initial Publication

 Read More

 ​CISA released six Industrial Control Systems (ICS) advisories on July 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

ICSA-25-205-01 Mitsubishi Electric CNC Series
ICSA-25-205-02 Network Thermostat X-Series WiFi Thermostats
ICSA-25-205-03 Honeywell Experion PKS
ICSA-25-205-04 LG Innotek Camera Model LNV5110R 
ICSMA-25-205-01 Medtronic MyCareLink Patient Monitor 
ICSA-22-202-04 ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations. 

CISA released six Industrial Control Systems (ICS) advisories on July 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• ICSA-25-205-01 Mitsubishi Electric CNC Series
• ICSA-25-205-02 Network Thermostat X-Series WiFi Thermostats
• ICSA-25-205-03 Honeywell Experion PKS
• ICSA-25-205-04 LG Innotek Camera Model LNV5110R
   
• ICSMA-25-205-01 Medtronic MyCareLink Patient Monitor
   
• ICSA-22-202-04 ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 7.0
ATTENTION: Low attack complexity
Vendor: Medtronic
Equipment: MyCareLink Patient Monitor 24950, 24952
Vulnerabilities: Cleartext Storage of Sensitive Information, Empty Password in Configuration File, Deserialization of Untrusted Data

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could lead to system compromise, unauthorized access to sensitive data, and manipulation of the monitor’s functionality.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Medtronic products are affected:

MyCareLink Patient Monitor model 24950: All versions
MyCareLink Patient Monitor model 24952: All versions

3.2 Vulnerability Overview
3.2.1 CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312
Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files.
CVE-2025-4394 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-4394. A base score of 7.0 has been calculated; the CVSS vector string is (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.2 EMPTY PASSWORD IN CONFIGURATION FILE CWE-258
Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access/modify system functionality.
CVE-2025-4395 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-4395. A base score of 7.0 has been calculated; the CVSS vector string is (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.3 DESERIALIZATION OF UNTRUSTED DATA CWE-502
Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges.
CVE-2025-4393 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-4393. A base score of 5.9 has been calculated; the CVSS vector string is (AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER
Ethan Morchy from Somerset Recon and Carl Mann, an independent researcher, reported these vulnerabilities to Medtronic.
4. MITIGATIONS
The identified vulnerabilities were reported as low-risk findings. An attacker would need to physically tamper with the monitor to exploit them. In response, starting in June 2025, Medtronic began deploying security updates to address these findings.
Medtronic recommends the following actions:

The security update process is performed automatically when the monitor is connected to the internet. Users should ensure that their remote monitor is plugged in to receive updates.
Physicians should continue to prescribe monitors as intended.
Users should maintain possession of their home monitor.
Users should only use home monitors provided directly from a healthcare provider or a Medtronic representative.

Users needing additional assistance should contact security@medtronic.com.
For more information regarding these vulnerabilities, refer to Medtronic’s security bulletin.
Users should follow CISA’s guidance in the following areas:

Securing the Internet of Things
Home Network Security

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
5. UPDATE HISTORY

July 24, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 7.0
• ATTENTION: Low attack complexity
• Vendor: Medtronic
• Equipment: MyCareLink Patient Monitor 24950, 24952
• Vulnerabilities: Cleartext Storage of Sensitive Information, Empty Password in Configuration File, Deserialization of Untrusted Data

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could lead to system compromise, unauthorized access to sensitive data, and manipulation of the monitor’s functionality.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Medtronic products are affected:

• MyCareLink Patient Monitor model 24950: All versions
• MyCareLink Patient Monitor model 24952: All versions

3.2 Vulnerability Overview

3.2.1 CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files.

CVE-2025-4394 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-4394. A base score of 7.0 has been calculated; the CVSS vector string is (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.2 EMPTY PASSWORD IN CONFIGURATION FILE CWE-258

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access/modify system functionality.

CVE-2025-4395 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-4395. A base score of 7.0 has been calculated; the CVSS vector string is (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.3 DESERIALIZATION OF UNTRUSTED DATA CWE-502

Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges.

CVE-2025-4393 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-4393. A base score of 5.9 has been calculated; the CVSS vector string is (AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER

Ethan Morchy from Somerset Recon and Carl Mann, an independent researcher, reported these vulnerabilities to Medtronic.

4. MITIGATIONS

The identified vulnerabilities were reported as low-risk findings. An attacker would need to physically tamper with the monitor to exploit them. In response, starting in June 2025, Medtronic began deploying security updates to address these findings.

Medtronic recommends the following actions:

• The security update process is performed automatically when the monitor is connected to the internet. Users should ensure that their remote monitor is plugged in to receive updates.
• Physicians should continue to prescribe monitors as intended.
• Users should maintain possession of their home monitor.
• Users should only use home monitors provided directly from a healthcare provider or a Medtronic representative.

Users needing additional assistance should contact security@medtronic.com.

For more information regarding these vulnerabilities, refer to Medtronic’s security bulletin.

Users should follow CISA’s guidance in the following areas:

• Securing the Internet of Things
• Home Network Security

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY

• July 24, 2025: Initial Publication

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v3 7.0
ATTENTION: Exploitable from a local network
Vendor: Mitsubishi Electric
Equipment: CNC Series
Vulnerability: Uncontrolled Search Path Element

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to execute malicious code by getting setup-launcher to load a malicious DLL.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Mitsubishi Electric CNC Series are affected:

NC Designer2: All versions
NC Designer: All versions
NC Configurator2: All versions
NC Analyzer2: All versions
NC Analyzer: All versions
NC Explorer: All versions
NC Monitor2: All versions
NC Monitor: All versions
NC Trainer2: “AB” and prior
NC Trainer2 plus: “AB” and prior
NC Trainer: All versions
NC Trainer plus: All versions
NC Visualizer: All versions
Remote Monitor Tool: All versions
MS Configurator: All versions
Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224): All versions
Mitsubishi Electric CNC communication software runtime library M70LC/M730LC: All versions
NC Virtual Simulator: All versions

3.2 Vulnerability Overview
3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Malicious code execution vulnerability via DLL hijacking due to Uncontrolled Search Path Element (CWE-427) exists in Flexera InstallShield used in multiple software tools and industrial IoT-related products for Mitsubishi Electric CNC Series.
CVE-2016-2542 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.0 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER
Sahil Shah reported this vulnerability to Mitsubishi Electric.
4. MITIGATIONS
The vulnerability is fixed in the following products and versions.  Download and install the fixed version from the Mitsubishi Electric download site:

NC Trainer2: “AC” or later
NC Trainer2 plus: “AC” or later

Note that there are no plans to release fixed versions for the following products:

NC Designer
NC Analyzer
NC Monitor
NC Trainer / NC Trainer plus
NC Visualizer
Remote Monitor Tool
MS Configurator

For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting this vulnerability:

Restrict physical access to the computer using the product.
Install an antivirus software in the computer using the affected product.
Do not open untrusted files or click untrusted links.
Do not run setup-launchers obtained from sources other than our branches, distributors or the Mitsubishi Electric FA website.
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.

For more information, see Mitsubishi Electric 2025-008.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.
5. UPDATE HISTORY

July 24, 2025: Initial Republication of Mitsubishi Electric 2025-008 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 7.0
• ATTENTION: Exploitable from a local network
• Vendor: Mitsubishi Electric
• Equipment: CNC Series
• Vulnerability: Uncontrolled Search Path Element

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute malicious code by getting setup-launcher to load a malicious DLL.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Mitsubishi Electric CNC Series are affected:

• NC Designer2: All versions
• NC Designer: All versions
• NC Configurator2: All versions
• NC Analyzer2: All versions
• NC Analyzer: All versions
• NC Explorer: All versions
• NC Monitor2: All versions
• NC Monitor: All versions
• NC Trainer2: “AB” and prior
• NC Trainer2 plus: “AB” and prior
• NC Trainer: All versions
• NC Trainer plus: All versions
• NC Visualizer: All versions
• Remote Monitor Tool: All versions
• MS Configurator: All versions
• Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224): All versions
• Mitsubishi Electric CNC communication software runtime library M70LC/M730LC: All versions
• NC Virtual Simulator: All versions

3.2 Vulnerability Overview

3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427

Malicious code execution vulnerability via DLL hijacking due to Uncontrolled Search Path Element (CWE-427) exists in Flexera InstallShield used in multiple software tools and industrial IoT-related products for Mitsubishi Electric CNC Series.

CVE-2016-2542 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.0 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Sahil Shah reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

The vulnerability is fixed in the following products and versions.  Download and install the fixed version from the Mitsubishi Electric download site:

• NC Trainer2: “AC” or later
• NC Trainer2 plus: “AC” or later

Note that there are no plans to release fixed versions for the following products:

• NC Designer
• NC Analyzer
• NC Monitor
• NC Trainer / NC Trainer plus
• NC Visualizer
• Remote Monitor Tool
• MS Configurator

For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting this vulnerability:

• Restrict physical access to the computer using the product.
• Install an antivirus software in the computer using the affected product.
• Do not open untrusted files or click untrusted links.
• Do not run setup-launchers obtained from sources other than our branches, distributors or the Mitsubishi Electric FA website.
• Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.

For more information, see Mitsubishi Electric 2025-008.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• July 24, 2025: Initial Republication of Mitsubishi Electric 2025-008

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v3 9.4
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Honeywell
Equipment: Experion PKS
Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Honeywell reports these vulnerabilities affect the following:

Experion PKS: All releases prior to R520.2 TCU9 Hot Fix 1
Experion PKS: All releases prior to R530 TCU3 Hot Fix 1

3.2 Vulnerability Overview
3.2.1 Use of Uninitialized Variable CWE-457
The Honeywell Experion PKS contains an uninitialized variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.
CVE-2025-2520 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3.2.2 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
The Honeywell Experion PKS contains a memory buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to overread buffers, which could result in improper index validation against buffer borders, leading to remote code execution.
CVE-2025-2521 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.6 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
3.2.3 Sensitive Information in Resource Not Removed Before Reuse CWE-226
The Honeywell Experion PKS contains sensitive information in resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which could result in buffer reuse, which may cause incorrect system behavior.
CVE-2025-2522 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
3.2.4 Integer Underflow (Wrap or Wraparound) CWE-191
The Honeywell Experion PKS contains an integer underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which could result in a failure during subtraction, allowing remote code execution.
CVE-2025-2523 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).
3.2.5 Deployment of Wrong Handler CWE-430
The Honeywell Experion PKS contains a deployment of wrong handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to input data manipulation, which could result in incorrect handling of packets, leading to remote code execution.
CVE-2025-3946 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
3.2.6 Integer Underflow (Wrap or Wraparound) CWE-191
The Honeywell Experion PKS contains an integer underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to input data manipulation, which could result in improper integer data value checking during subtraction, leading to a denial of service.
CVE-2025-3947 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Healthcare and Public Health, Water and Wastewater Systems
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER
Positive Technologies reported these vulnerabilities to Honeywell.
4. MITIGATIONS
Honeywell recommends updating Experion PKS R520.2 TCU9 Hot Fix 1 or R530 TCU3 Hot Fix 1. For more information, see the Security Notice.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Ensure the least-privilege user principle is followed.
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

July 24, 2025: Initial Republication of Honeywell security notice. 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.4
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Honeywell
• Equipment: Experion PKS
• Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Honeywell reports these vulnerabilities affect the following:

• Experion PKS: All releases prior to R520.2 TCU9 Hot Fix 1
• Experion PKS: All releases prior to R530 TCU3 Hot Fix 1

3.2 Vulnerability Overview

3.2.1 Use of Uninitialized Variable CWE-457

The Honeywell Experion PKS contains an uninitialized variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.

CVE-2025-2520 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119

The Honeywell Experion PKS contains a memory buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to overread buffers, which could result in improper index validation against buffer borders, leading to remote code execution.

CVE-2025-2521 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.6 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

3.2.3 Sensitive Information in Resource Not Removed Before Reuse CWE-226

The Honeywell Experion PKS contains sensitive information in resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which could result in buffer reuse, which may cause incorrect system behavior.

CVE-2025-2522 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

3.2.4 Integer Underflow (Wrap or Wraparound) CWE-191

The Honeywell Experion PKS contains an integer underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to communication channel manipulation, which could result in a failure during subtraction, allowing remote code execution.

CVE-2025-2523 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).

3.2.5 Deployment of Wrong Handler CWE-430

The Honeywell Experion PKS contains a deployment of wrong handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to input data manipulation, which could result in incorrect handling of packets, leading to remote code execution.

CVE-2025-3946 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

3.2.6 Integer Underflow (Wrap or Wraparound) CWE-191

The Honeywell Experion PKS contains an integer underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to input data manipulation, which could result in improper integer data value checking during subtraction, leading to a denial of service.

CVE-2025-3947 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Healthcare and Public Health, Water and Wastewater Systems
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Positive Technologies reported these vulnerabilities to Honeywell.

4. MITIGATIONS

Honeywell recommends updating Experion PKS R520.2 TCU9 Hot Fix 1 or R530 TCU3 Hot Fix 1. For more information, see the Security Notice.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Ensure the least-privilege user principle is followed.
• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• July 24, 2025: Initial Republication of Honeywell security notice.

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 9.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Network Thermostat
Equipment: X-Series WiFi thermostats
Vulnerability: Missing Authentication for Critical Function

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Network Thermostat product is affected:

X-Series WiFi thermostats: Versions v4.5 up to but not including v4.6
X-Series WiFi thermostats: Versions v9.6 up to but not including v9.46
X-Series WiFi thermostats: Versions v10.1 up to but not including v10.29
X-Series WiFi thermostats: Versions v11.1 up to but not including v11.5

3.2 Vulnerability Overview
3.2.1 Missing Authentication for Critical Function CWE-306
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the Local Area Network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat’s embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
CVE-2025-6260 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-6260. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities
COUNTRIES/AREAS DEPLOYED: USA, Canada
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER
Souvik Kandar reported this vulnerability to CISA.
4. MITIGATIONS
Network Thermostat recommends users to update to the following (or newer) versions:

X-Series WiFi thermostats with v4.x to a minimum of v4.6
X-Series WiFi thermostats with v9.x to a minimum of v9.46
X-Series WiFi thermostats with v10.x to a minimum of v10.29
X-Series WiFi thermostats with v11.x to a minimum of v11.5

This update was applied automatically to reachable units, requiring no action from end users.
If end users would like their units behind firewalls to be updated, contact Network Thermostat at support@networkthermostat.com to coordinate an update.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

July 24, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 9.3
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Network Thermostat
• Equipment: X-Series WiFi thermostats
• Vulnerability: Missing Authentication for Critical Function

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Network Thermostat product is affected:

• X-Series WiFi thermostats: Versions v4.5 up to but not including v4.6
• X-Series WiFi thermostats: Versions v9.6 up to but not including v9.46
• X-Series WiFi thermostats: Versions v10.1 up to but not including v10.29
• X-Series WiFi thermostats: Versions v11.1 up to but not including v11.5

3.2 Vulnerability Overview

3.2.1 Missing Authentication for Critical Function CWE-306

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the Local Area Network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat’s embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

CVE-2025-6260 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-6260. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities
• COUNTRIES/AREAS DEPLOYED: USA, Canada
• COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Souvik Kandar reported this vulnerability to CISA.

4. MITIGATIONS

Network Thermostat recommends users to update to the following (or newer) versions:

• X-Series WiFi thermostats with v4.x to a minimum of v4.6
• X-Series WiFi thermostats with v9.x to a minimum of v9.46
• X-Series WiFi thermostats with v10.x to a minimum of v10.29
• X-Series WiFi thermostats with v11.x to a minimum of v11.5

This update was applied automatically to reachable units, requiring no action from end users.

If end users would like their units behind firewalls to be updated, contact Network Thermostat at support@networkthermostat.com to coordinate an update.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 24, 2025: Initial Publication

 Read More

 ​CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
• CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
• CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

 Read More

 ​CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability
CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.  

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability
• CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 5.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Schneider Electric
Equipment: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO)
Vulnerability: Exposure of Resource to Wrong Sphere

2. RISK EVALUATION
Successful exploitation of this vulnerability could provide other authenticated users with potentially inappropriate access to TGML diagrams.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Schneider Electric reports the following products are affected:

EcoStruxure Power Monitoring Expert (PME): 2023
EcoStruxure Power Monitoring Expert (PME): 2023 R2
EcoStruxure Power Monitoring Expert (PME): 2024
EcoStruxure Power Monitoring Expert (PME): 2024 R2
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2022
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2024

3.2 Vulnerability Overview
3.2.1 EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668
A resource exposure vulnerability exists that exposes TGML diagram resources to unauthorized control, allowing other authenticated users unauthorized access to TGML diagrams.
CVE-2025-6788 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-6788. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER
Schneider Electric reported this vulnerability to CISA.
4. MITIGATIONS
Schneider Electric has identified the following specific remediations users can apply to reduce risk:

EcoStruxure Power Monitoring Expert (PME) 2023, 2023 R2: Hotfix_199767 is available and includes a fix for this vulnerability.
EcoStruxure Power Monitoring Expert (PME) 2024: Hotfix_256448_Diagrams-Release.13.0.25182.01 is available and includes a fix for this vulnerability.
EcoStruxure Power Monitoring Expert (PME) 2024 R2: Hotfix_256448_Diagrams-Release.13.1.25182.01 is available and includes a fix for this vulnerability.
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2022: Hotfix_199767 is available and includes a fix for this vulnerability.
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2024: Hotfix_256448_Diagrams-Release.13.0.25182.0 is available and includes a fix for this vulnerability.

Contact Schneider Electric’s Customer Care Center to download these hotfixes.
Schneider Electric recommends users employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.
If users choose not to apply the above-mentioned remediation, Schneider Electric recommends the immediate removal of TGML diagrams from multi-tenant managed systems or on-premises systems and reverting to Vista diagrams.
For more information, see the associated Schneider Electric security advisory SEVD-2025-189-04: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) with Advanced Reporting and Dashboards PDF version, CSAF version.
Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the one intended for that device.
Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
When remote access is required, use secure methods such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-04 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 5.3
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Schneider Electric
• Equipment: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO)
• Vulnerability: Exposure of Resource to Wrong Sphere

2. RISK EVALUATION

Successful exploitation of this vulnerability could provide other authenticated users with potentially inappropriate access to TGML diagrams.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected:

• EcoStruxure Power Monitoring Expert (PME): 2023
• EcoStruxure Power Monitoring Expert (PME): 2023 R2
• EcoStruxure Power Monitoring Expert (PME): 2024
• EcoStruxure Power Monitoring Expert (PME): 2024 R2
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2022
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2024

3.2 Vulnerability Overview

3.2.1 EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668

A resource exposure vulnerability exists that exposes TGML diagram resources to unauthorized control, allowing other authenticated users unauthorized access to TGML diagrams.

CVE-2025-6788 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2025-6788. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Schneider Electric reported this vulnerability to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific remediations users can apply to reduce risk:

• EcoStruxure Power Monitoring Expert (PME) 2023, 2023 R2: Hotfix_199767 is available and includes a fix for this vulnerability.
• EcoStruxure Power Monitoring Expert (PME) 2024: Hotfix_256448_Diagrams-Release.13.0.25182.01 is available and includes a fix for this vulnerability.
• EcoStruxure Power Monitoring Expert (PME) 2024 R2: Hotfix_256448_Diagrams-Release.13.1.25182.01 is available and includes a fix for this vulnerability.
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2022: Hotfix_199767 is available and includes a fix for this vulnerability.
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2024: Hotfix_256448_Diagrams-Release.13.0.25182.0 is available and includes a fix for this vulnerability.

Contact Schneider Electric’s Customer Care Center to download these hotfixes.

Schneider Electric recommends users employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.

If users choose not to apply the above-mentioned remediation, Schneider Electric recommends the immediate removal of TGML diagrams from multi-tenant managed systems or on-premises systems and reverting to Vista diagrams.

For more information, see the associated Schneider Electric security advisory SEVD-2025-189-04: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) with Advanced Reporting and Dashboards PDF version, CSAF version.

Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

• Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
• Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
• Place all controllers in locked cabinets and never leave them in the “Program” mode.
• Never connect programming software to any network other than the one intended for that device.
• Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
• Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
• Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
• When remote access is required, use secure methods such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-04

 Read More