Category: Security Feeds

 ​CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
• CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
• CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
• CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

 Read More

 ​CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability
CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.  

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability
• CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 5.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Schneider Electric
Equipment: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO)
Vulnerability: Exposure of Resource to Wrong Sphere

2. RISK EVALUATION
Successful exploitation of this vulnerability could provide other authenticated users with potentially inappropriate access to TGML diagrams.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Schneider Electric reports the following products are affected:

EcoStruxure Power Monitoring Expert (PME): 2023
EcoStruxure Power Monitoring Expert (PME): 2023 R2
EcoStruxure Power Monitoring Expert (PME): 2024
EcoStruxure Power Monitoring Expert (PME): 2024 R2
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2022
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2024

3.2 Vulnerability Overview
3.2.1 EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668
A resource exposure vulnerability exists that exposes TGML diagram resources to unauthorized control, allowing other authenticated users unauthorized access to TGML diagrams.
CVE-2025-6788 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-6788. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER
Schneider Electric reported this vulnerability to CISA.
4. MITIGATIONS
Schneider Electric has identified the following specific remediations users can apply to reduce risk:

EcoStruxure Power Monitoring Expert (PME) 2023, 2023 R2: Hotfix_199767 is available and includes a fix for this vulnerability.
EcoStruxure Power Monitoring Expert (PME) 2024: Hotfix_256448_Diagrams-Release.13.0.25182.01 is available and includes a fix for this vulnerability.
EcoStruxure Power Monitoring Expert (PME) 2024 R2: Hotfix_256448_Diagrams-Release.13.1.25182.01 is available and includes a fix for this vulnerability.
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2022: Hotfix_199767 is available and includes a fix for this vulnerability.
EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2024: Hotfix_256448_Diagrams-Release.13.0.25182.0 is available and includes a fix for this vulnerability.

Contact Schneider Electric’s Customer Care Center to download these hotfixes.
Schneider Electric recommends users employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.
If users choose not to apply the above-mentioned remediation, Schneider Electric recommends the immediate removal of TGML diagrams from multi-tenant managed systems or on-premises systems and reverting to Vista diagrams.
For more information, see the associated Schneider Electric security advisory SEVD-2025-189-04: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) with Advanced Reporting and Dashboards PDF version, CSAF version.
Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the one intended for that device.
Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
When remote access is required, use secure methods such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-04 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 5.3
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Schneider Electric
• Equipment: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO)
• Vulnerability: Exposure of Resource to Wrong Sphere

2. RISK EVALUATION

Successful exploitation of this vulnerability could provide other authenticated users with potentially inappropriate access to TGML diagrams.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected:

• EcoStruxure Power Monitoring Expert (PME): 2023
• EcoStruxure Power Monitoring Expert (PME): 2023 R2
• EcoStruxure Power Monitoring Expert (PME): 2024
• EcoStruxure Power Monitoring Expert (PME): 2024 R2
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2022
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module: 2024

3.2 Vulnerability Overview

3.2.1 EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668

A resource exposure vulnerability exists that exposes TGML diagram resources to unauthorized control, allowing other authenticated users unauthorized access to TGML diagrams.

CVE-2025-6788 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2025-6788. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Schneider Electric reported this vulnerability to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific remediations users can apply to reduce risk:

• EcoStruxure Power Monitoring Expert (PME) 2023, 2023 R2: Hotfix_199767 is available and includes a fix for this vulnerability.
• EcoStruxure Power Monitoring Expert (PME) 2024: Hotfix_256448_Diagrams-Release.13.0.25182.01 is available and includes a fix for this vulnerability.
• EcoStruxure Power Monitoring Expert (PME) 2024 R2: Hotfix_256448_Diagrams-Release.13.1.25182.01 is available and includes a fix for this vulnerability.
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2022: Hotfix_199767 is available and includes a fix for this vulnerability.
• EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module 2024: Hotfix_256448_Diagrams-Release.13.0.25182.0 is available and includes a fix for this vulnerability.

Contact Schneider Electric’s Customer Care Center to download these hotfixes.

Schneider Electric recommends users employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.

If users choose not to apply the above-mentioned remediation, Schneider Electric recommends the immediate removal of TGML diagrams from multi-tenant managed systems or on-premises systems and reverting to Vista diagrams.

For more information, see the associated Schneider Electric security advisory SEVD-2025-189-04: EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) with Advanced Reporting and Dashboards PDF version, CSAF version.

Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

• Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
• Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
• Place all controllers in locked cabinets and never leave them in the “Program” mode.
• Never connect programming software to any network other than the one intended for that device.
• Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
• Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
• Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
• When remote access is required, use secure methods such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-04

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 9.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Schneider Electric
Equipment: EcoStruxure IT Data Center Expert
Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’), Insufficient Entropy, Improper Control of Generation of Code (‘Code Injection’), Server-Side Request Forgery (SSRF), Improper Privilege Management, and Improper Restriction of XML External Entity Reference

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to disrupt operations and access system data.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Schneider Electric reports the following product is affected:

EcoStruxure IT Data Center Expert: Versions v8.3 and prior

3.2 Vulnerability Overview
3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78
An improper neutralization of special elements used in an OS command (‘OS command injection’) vulnerability exists, which could cause unauthenticated remote code execution when a malicious folder is created via the HTTP web interface when enabled. HTTP is disabled by default.
CVE-2025-50121 has been assigned to this vulnerability. A CVSS v3.1 base score of 10.0 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-50121. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).
3.2.2 INSUFFICIENT ENTROPY CWE-331
An insufficient entropy vulnerability exists, which could cause the root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts.
CVE-2025-50122 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-50122. A base score of 8.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).
3.2.3 IMPROPER CONTROL OF GENERATION OF CODE (‘CODE INJECTION’) CWE-94
An improper control of generation of code (‘code injection’) vulnerability exists, which could cause remote command execution by a privileged account when the server is accessed via a console and the hostname input is exploited.
CVE-2025-50123 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-50123. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).
3.2.4 SERVER-SIDE REQUEST FORGERY (SSRF) CWE-918
A server-side request forgery (SSRF) vulnerability exists, which could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of the host request header.
CVE-2025-50125 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
A CVSS v4 score has also been calculated for CVE-2025-50125. A base score of 6.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N).
3.2.5 IMPROPER PRIVILEGE MANAGEMENT CWE-269
An improper privilege management vulnerability exists, which could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script.
CVE-2025-50124 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-50124. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).
3.2.6 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
An improper restriction of XML external entity reference vulnerability exists, which could cause manipulation of SOAP API calls and XML external entities injection, resulting in unauthorized file access when the server is accessed via the network using an application account.
CVE-2025-6438 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-6438. A base score of 5.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER
Jaggar Henry and Jim Becher of KoreLogic, Inc. reported these vulnerabilities to Schneider Electric.
4. MITIGATIONS
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Schneider Electric EcoStruxure IT Data Center Expert Version 8.3 and prior: Version 9.0 of EcoStruxure IT Data Center Expert includes fixes for these vulnerabilities and is available upon request from Schneider Electric’s Customer Care Center.
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

Harden the DCE instance according to the cybersecurity best practices documented in the EcoStruxure IT Data Center Expert Security Handbook

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-189-01 EcoStruxure IT Data Center Expert – SEVD-2025-189-01 PDF Version, EcoStruxure IT Data Center Expert – SEVD-2025-189-01 CSAF Version.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric CPCERT SEVD-2025-189-01 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 9.5
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Schneider Electric
• Equipment: EcoStruxure IT Data Center Expert
• Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’), Insufficient Entropy, Improper Control of Generation of Code (‘Code Injection’), Server-Side Request Forgery (SSRF), Improper Privilege Management, and Improper Restriction of XML External Entity Reference

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to disrupt operations and access system data.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following product is affected:

• EcoStruxure IT Data Center Expert: Versions v8.3 and prior

3.2 Vulnerability Overview

3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78

An improper neutralization of special elements used in an OS command (‘OS command injection’) vulnerability exists, which could cause unauthenticated remote code execution when a malicious folder is created via the HTTP web interface when enabled. HTTP is disabled by default.

CVE-2025-50121 has been assigned to this vulnerability. A CVSS v3.1 base score of 10.0 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-50121. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).

3.2.2 INSUFFICIENT ENTROPY CWE-331

An insufficient entropy vulnerability exists, which could cause the root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts.

CVE-2025-50122 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-50122. A base score of 8.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).

3.2.3 IMPROPER CONTROL OF GENERATION OF CODE (‘CODE INJECTION’) CWE-94

An improper control of generation of code (‘code injection’) vulnerability exists, which could cause remote command execution by a privileged account when the server is accessed via a console and the hostname input is exploited.

CVE-2025-50123 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-50123. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).

3.2.4 SERVER-SIDE REQUEST FORGERY (SSRF) CWE-918

A server-side request forgery (SSRF) vulnerability exists, which could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of the host request header.

CVE-2025-50125 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2025-50125. A base score of 6.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N).

3.2.5 IMPROPER PRIVILEGE MANAGEMENT CWE-269

An improper privilege management vulnerability exists, which could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script.

CVE-2025-50124 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-50124. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H).

3.2.6 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611

An improper restriction of XML external entity reference vulnerability exists, which could cause manipulation of SOAP API calls and XML external entities injection, resulting in unauthorized file access when the server is accessed via the network using an application account.

CVE-2025-6438 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2025-6438. A base score of 5.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Jaggar Henry and Jim Becher of KoreLogic, Inc. reported these vulnerabilities to Schneider Electric.

4. MITIGATIONS

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Schneider Electric EcoStruxure IT Data Center Expert Version 8.3 and prior: Version 9.0 of EcoStruxure IT Data Center Expert includes fixes for these vulnerabilities and is available upon request from Schneider Electric’s Customer Care Center.
• If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
  • Harden the DCE instance according to the cybersecurity best practices documented in the EcoStruxure IT Data Center Expert Security Handbook

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-189-01 EcoStruxure IT Data Center Expert – SEVD-2025-189-01 PDF Version, EcoStruxure IT Data Center Expert – SEVD-2025-189-01 CSAF Version.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• July 22, 2025: Initial Republication of Schneider Electric CPCERT SEVD-2025-189-01

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v3 8.8
ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
Vendor: Schneider Electric
Equipment: EcoStruxure Power Operation
Vulnerabilities: Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’), Integer Overflow to Buffer Overflow, Improper Handling of Highly Compressed Data (Data Amplification), Out-of-bounds Write, Uncontrolled Resource Consumption

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Schneider Electric reports the following products use an affected version of the PostgreSQL database server:

EcoStruxure Power Operation (EPO): 2022 CU6 and prior
EcoStruxure Power Operation (EPO): 2024 CU1 and prior

3.2 Vulnerability Overview
3.2.1 Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) CWE-95
Pillow Version 10.1.0 allows PIL.ImageMath.eval arbitrary code execution via the environment parameter. This is a different vulnerability from CVE-2022-22817, which pertains to the expression parameter.
CVE-2023-50447 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
3.2.2 Integer Overflow to Buffer Overflow CWE-680
In _imagingcms.c in Pillow prior to 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVE-2024-28219 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.7 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
3.2.3 Improper Handling of Highly Compressed Data (Data Amplification) CWE-409
Versions of Pillow before 9.2.0 improperly handle highly compressed GIF data (data amplification).
CVE-2022-45198 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3.2.4 Out-of-bounds Write CWE-787
A heap buffer overflow in vp8 encoding in libvpx, used by Google Chrome versions prior to 117.0.5938.132 and libvpx Version 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2023-5217 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
3.2.5 Uncontrolled Resource Consumption CWE-400
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM  immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if the connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing a memory leak. This results in denial of service through memory exhaustion. This vulnerability was patched in Versions 1.26.3, 1.25.8, 1.24.9, 1.23.11.
CVE-2023-35945 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3.2.6 Uncontrolled Resource Consumption CWE-400
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as was exploited in the wild from August to October 2023.
CVE-2023-44487 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER
Schneider Electric reported these vulnerabilities to CISA.
4. MITIGATIONS
EcoStruxure Power Operation 2024 CU2 includes fixes for these vulnerabilities and is available for download.
Schneider Electric recommends users to employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.
If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:

If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQL,OR
For users of waveform analysis and ETAP simulation features, Schneider Electric recommends all deployments of EPO only accept connections from localhost in PostgresSQL. Contact Schneider Electric’s Customer Care Center for information on how to modify PostgreSQL. Additionally, Schneider Electric recommends users manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher.

For more information, see the associated Schneider Electric security advisory SEVD-2025-189-03: EcoStruxure Power Operation PDF version, CSAF version.
Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network.
Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the one intended for that device.
Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
When remote access is required, use secure methods such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-03 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 8.8
• ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
• Vendor: Schneider Electric
• Equipment: EcoStruxure Power Operation
• Vulnerabilities: Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’), Integer Overflow to Buffer Overflow, Improper Handling of Highly Compressed Data (Data Amplification), Out-of-bounds Write, Uncontrolled Resource Consumption

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products use an affected version of the PostgreSQL database server:

• EcoStruxure Power Operation (EPO): 2022 CU6 and prior
• EcoStruxure Power Operation (EPO): 2024 CU1 and prior

3.2 Vulnerability Overview

3.2.1 Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) CWE-95

Pillow Version 10.1.0 allows PIL.ImageMath.eval arbitrary code execution via the environment parameter. This is a different vulnerability from CVE-2022-22817, which pertains to the expression parameter.

CVE-2023-50447 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2 Integer Overflow to Buffer Overflow CWE-680

In _imagingcms.c in Pillow prior to 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

CVE-2024-28219 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.7 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

3.2.3 Improper Handling of Highly Compressed Data (Data Amplification) CWE-409

Versions of Pillow before 9.2.0 improperly handle highly compressed GIF data (data amplification).

CVE-2022-45198 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.4 Out-of-bounds Write CWE-787

A heap buffer overflow in vp8 encoding in libvpx, used by Google Chrome versions prior to 117.0.5938.132 and libvpx Version 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2023-5217 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.5 Uncontrolled Resource Consumption CWE-400

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM  immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if the connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing a memory leak. This results in denial of service through memory exhaustion. This vulnerability was patched in Versions 1.26.3, 1.25.8, 1.24.9, 1.23.11.

CVE-2023-35945 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.6 Uncontrolled Resource Consumption CWE-400

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as was exploited in the wild from August to October 2023.

CVE-2023-44487 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Schneider Electric reported these vulnerabilities to CISA.

4. MITIGATIONS

EcoStruxure Power Operation 2024 CU2 includes fixes for these vulnerabilities and is available for download.

Schneider Electric recommends users to employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric’s Customer Care Center for assistance removing a patch.

If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:

• If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQL,
  OR
• For users of waveform analysis and ETAP simulation features, Schneider Electric recommends all deployments of EPO only accept connections from localhost in PostgresSQL. Contact Schneider Electric’s Customer Care Center for information on how to modify PostgreSQL. Additionally, Schneider Electric recommends users manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher.

For more information, see the associated Schneider Electric security advisory SEVD-2025-189-03: EcoStruxure Power Operation PDF version, CSAF version.

Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

• Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network.
• Install physical controls to prevent unauthorized personnel from accessing industrial control and safety systems, components, peripheral equipment, and networks.
• Place all controllers in locked cabinets and never leave them in the “Program” mode.
• Never connect programming software to any network other than the one intended for that device.
• Scan all methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., before use in terminals or any nodes connected to these networks.
• Never allow mobile devices that have connected to any network other than the intended network to connect to safety or control networks without proper sanitation.
• Minimize network exposure for all control system devices and systems, ensuring they are not accessible from the Internet.
• When remote access is required, use secure methods such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
  For more information, refer to the Schneider Electric recommended cybersecurity best practices document.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

5. UPDATE HISTORY

• July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-03

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.6
ATTENTION: Low attack complexity
Vendor: Lantronix
Equipment: Provisioning Manager
Vulnerability: Improper Restriction of XML External Entity Reference

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to perform a cross-site scripting attack, which could result in remote code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Lantronix products are affected:

Provisioning Manager: Versions 7.10.2 and prior

3.2 Vulnerability Overview
3.2.1 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Provisioning Manager is vulnerable to XML External Entity (XXE) attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
CVE-2025-7766 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.0 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-7766. A base score of 8.6 has been calculated; the CVSS vector string is (AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Information Technology
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER
Robert McLellan reported this vulnerability to CISA.
4. MITIGATIONS
Lantronix has provided a fix and recommends users update to v7.10.4 or later.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY

July 22, 2025: Initial Publication 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.6
• ATTENTION: Low attack complexity
• Vendor: Lantronix
• Equipment: Provisioning Manager
• Vulnerability: Improper Restriction of XML External Entity Reference

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to perform a cross-site scripting attack, which could result in remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Lantronix products are affected:

• Provisioning Manager: Versions 7.10.2 and prior

3.2 Vulnerability Overview

3.2.1 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611

Provisioning Manager is vulnerable to XML External Entity (XXE) attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.

CVE-2025-7766 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.0 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-7766. A base score of 8.6 has been calculated; the CVSS vector string is (AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Information Technology
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Robert McLellan reported this vulnerability to CISA.

4. MITIGATIONS

Lantronix has provided a fix and recommends users update to v7.10.4 or later.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• July 22, 2025: Initial Publication

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v3 6.9
ATTENTION: Exploitable remotely
Vendor: Schneider Electric
Equipment: System Monitor Application
Vulnerability: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to execute untrusted code.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Schneider Electric reports the following products are affected:

System Monitor application in Harmony Industrial PC series: All versions
System Monitor application in Pro-face Industrial PC series: All versions

3.2 Vulnerability Overview
3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing
CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER
Schneider Electric CPCERT reported this vulnerability to CISA.
4. MITIGATIONS
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Schneider Electric System Monitor application in Harmony Industrial PC series: Users can uninstall System Monitor application using the installer available for download here.
Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
Schneider Electric System Monitor application in Harmony Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

Stop the system monitor if not required by turning off the services as specified in the Harmony Industrial PC Series User Manual.
Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

Schneider Electric System Monitor application in Pro-face Industrial PC series: Users can uninstall System Monitor application using the installer available for download here
Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
Schneider Electric System Monitor application in Pro-face Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

Stop the system monitor if not required by turning off the services as specified in the Pro-face PS5000 legacy industrial PC Series User Manual.
Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-189-02 System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs – SEVD-2025-189-02 PDF Version, System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs – SEVD-2025-189-02 CSAF Version.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric CPCERT SEVD-2025-189-02 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 6.9
• ATTENTION: Exploitable remotely
• Vendor: Schneider Electric
• Equipment: System Monitor Application
• Vulnerability: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute untrusted code.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected:

• System Monitor application in Harmony Industrial PC series: All versions
• System Monitor application in Pro-face Industrial PC series: All versions

3.2 Vulnerability Overview

3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing

CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Schneider Electric CPCERT reported this vulnerability to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Schneider Electric System Monitor application in Harmony Industrial PC series: Users can uninstall System Monitor application using the installer available for download here.
• Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
• Schneider Electric System Monitor application in Harmony Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
  • Stop the system monitor if not required by turning off the services as specified in the Harmony Industrial PC Series User Manual.
  • Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.
• Schneider Electric System Monitor application in Pro-face Industrial PC series: Users can uninstall System Monitor application using the installer available for download here
• Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
• Schneider Electric System Monitor application in Pro-face Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
  • Stop the system monitor if not required by turning off the services as specified in the Pro-face PS5000 legacy industrial PC Series User Manual.
  • Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-189-02 System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs – SEVD-2025-189-02 PDF Version, System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs – SEVD-2025-189-02 CSAF Version.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• July 22, 2025: Initial Republication of Schneider Electric CPCERT SEVD-2025-189-02

 Read More

 ​View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 8.7
ATTENTION: Exploitable remotely/low attack complexity
Vendor: DuraComm Corporation
Equipment: SPM-500 DP-10iN-100-MU
Vulnerabilities: Cleartext Transmission of Sensitive Information, Missing Authentication for a Critical Function, Improper Neutralization of Input During Web Page Generation

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information or cause a denial-of-service condition.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of DuraComm SPM-500 DP-10iN-100-MU, a power distribution panel, are affected:

SPM-500 DP-10iN-100-MU: Version 4.10 and prior

3.2 Vulnerability Overview
3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
The affected product is vulnerable to a cross-site scripting (XSS) attack. This could allow an attacker to prevent legitimate users from accessing the web interface.
CVE-2025-41425 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-41425. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.2 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
The affected product lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device.
CVE-2025-48733 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A CVSS v4 score has also been calculated for CVE-2025-48733. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).
3.2.3 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
The affected product transmits sensitive data without encryption over a channel that could be intercepted by attackers.
CVE-2025-53703 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-53703. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER
Brandon Vincent of Arizona Public Service reported these vulnerabilities to CISA.
4. MITIGATIONS
DuraComm recommends users update to Version 4.10A. Contact DuraComm to obtain the update.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY

July 22, 2025: Initial Publication. 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.7
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: DuraComm Corporation
• Equipment: SPM-500 DP-10iN-100-MU
• Vulnerabilities: Cleartext Transmission of Sensitive Information, Missing Authentication for a Critical Function, Improper Neutralization of Input During Web Page Generation

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information or cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of DuraComm SPM-500 DP-10iN-100-MU, a power distribution panel, are affected:

• SPM-500 DP-10iN-100-MU: Version 4.10 and prior

3.2 Vulnerability Overview

3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79

The affected product is vulnerable to a cross-site scripting (XSS) attack. This could allow an attacker to prevent legitimate users from accessing the web interface.

CVE-2025-41425 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-41425. A base score of 7.2 has been calculated; the CVSS vector string is (CVSS:4.0/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.2 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306

The affected product lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device.

CVE-2025-48733 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A CVSS v4 score has also been calculated for CVE-2025-48733. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).

3.2.3 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

The affected product transmits sensitive data without encryption over a channel that could be intercepted by attackers.

CVE-2025-53703 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2025-53703. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Brandon Vincent of Arizona Public Service reported these vulnerabilities to CISA.

4. MITIGATIONS

DuraComm recommends users update to Version 4.10A. Contact DuraComm to obtain the update.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

• Do not click web links or open attachments in unsolicited email messages.
• Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
• Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• July 22, 2025: Initial Publication.

 Read More

 ​CISA released nine Industrial Control Systems (ICS) advisories on July 22, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

ICSA-25-203-01 DuraComm DP-10iN-100-MU
ICSA-25-203-02 Lantronix Provisioning Manager
ICSA-25-203-03 Schneider Electric EcoStruxure
ICSA-25-203-04 Schneider Electric EcoStruxure Power Operation
ICSA-25-203-05 Schneider Electric System Monitor Application
ICSA-25-203-06 Schneider Electric EcoStruxture IT Data Center Expert 
ICSA-25-175-03 Schneider Electric Modicon Controllers (Update A)
ICSA-25-175-04 Schneider Electric EVLink WallBox (Update A)
ICSA-25-014-02 Schneider Electric Vijeo Designer (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations. 

CISA released nine Industrial Control Systems (ICS) advisories on July 22, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

• ICSA-25-203-01 DuraComm DP-10iN-100-MU
• ICSA-25-203-02 Lantronix Provisioning Manager
• ICSA-25-203-03 Schneider Electric EcoStruxure
• ICSA-25-203-04 Schneider Electric EcoStruxure Power Operation
• ICSA-25-203-05 Schneider Electric System Monitor Application
• ICSA-25-203-06 Schneider Electric EcoStruxture IT Data Center Expert
   
• ICSA-25-175-03 Schneider Electric Modicon Controllers (Update A)
• ICSA-25-175-04 Schneider Electric EVLink WallBox (Update A)
• ICSA-25-014-02 Schneider Electric Vijeo Designer (Update A)

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

 Read More

 ​CISA, in partnership with the Federal Bureau of Investigation (FBI), the Department of Health and Human Services, and the Multi-State Information Sharing and Analysis Center issued a joint Cybersecurity Advisory to help protect businesses and critical infrastructure organizations in North America and Europe against Interlock ransomware.  

This advisory highlights known Interlock ransomware indicators of compromise and tactics, techniques, and procedures identified through recent FBI investigations.  

Actions organizations can take today to mitigate Interlock ransomware threat activity include:  

Preventing initial access by implementing domain name system filtering and web access firewalls and training users to spot social engineering attempts.  

Mitigating known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date.  

Segmenting networks to restrict lateral movement from initial infected devices and other devices in the same organization.  

Implementing identity, credential, and access management policies across the organization and then requiring multifactor authentication for all services to the extent possible.  

The #StopRansomware Interlock joint Cybersecurity Advisory is part of an ongoing effort to publish guidance for network defenders that detail various ransomware variants and ransomware threat actors. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.  

 Read More