Le CERT-FR a connaissance de nombreuses compromissions de Danfoss série AK-SM et AK-SC. L'exposition d'une interface de gestion sur Internet est contraire aux bonnes pratiques. Dans le cas où l’administration à distance est impérative, une première mesure temporaire peut consister à restreindre...
Danfoss FR
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
KEV ✓ · ransomware EPSS 1.00 CVE-2014-6278 CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2019-11510 CVE-2021-22205 CVE-2021-3199 CVE-2023-22894 Microsoft veřejná správa výroba a průmysl zdravotnictví školství US
View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) openHistorian <2.8.580, <2.8.585 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) CVSS Vendor…
EPSS 0.01 CVE-2026-100730 CVE-2026-101022 CVE-2026-104629 CVE-2026-105278 CVE-2026-105281 CVE-2026-85479 Grid Protection Alliance energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code. The following versions of Satel Netco Design are affected: Satel Netco Design CVSS Vendor Equipment v3 8.8 Satel Satel Netco Design 3 Vulnerabilities Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),…
EPSS 0.00 CVE-2026-101024 CVE-2026-104628 CVE-2026-105269 CVE-2026-105275 Satel telekomunikace US
View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. This action can be scripted on the malicious user's local machine to cause continuous rebooting of the switch. The following versions of Red Lion Controls N-Tron 700…
EPSS 0.00 CVE-2026-28745 CVE-2026-29797 CVE-2026-32645 CVE-2026-33272 CVE-2026-33367 CVE-2026-39453 CVE-2026-39460 Red Lion Controls výroba a průmysl telekomunikace US
[VDE-2026-105] The Docker-based COMBIVIS Control Runtime service is affected by several vulnerabilities in CODESYS Runtime Toolkit 3.5.21.10. These vulnerabilities are resolved in COMBIVIS Control Runtime 2.1.0.
EPSS 0.01 CVE-2025-41659 CVE-2025-41691 CVE-2025-41738 CVE-2025-41739 KEB Automation CODESYS DE
US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-8065, CVE-2026-8066, CVE-2026-8067, CVE-2010-2965, CVE-2014-9195, CVE-2023-46143, CVE-2024-8176, CVE-2025-59375, CVE-2026-34197, CVE-2026-7395, CVE-2026-11796, CVE-2026-15340, CVE-2026-27872, CVE-2026-27873, Summary: CISA has released six Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits…
CVSS 9.8 Hitachi Energy Johnson Controls Savannah FI
Serial number: AV26-1010 Date: October 7, 2026 As of October 6, 2026, Johnson Controls is affected by a vulnerability in the following product: Illustra Standard - L4L China Prior to 6.0.0.66394 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting Illustra Standard - L4L China Johnson Controls - Product Security Advisories
The Operational Technology Cybersecurity Coalition (OTCC) released a white paper on Tuesday urging the Cybersecurity and Infrastructure Security Agency (CISA) to create a new directive centered around operational technology, which is used to monitor and control critical infrastructure.
US
Path Traversal in Satel Iberia SenNet Datalogger Serie 200 Wed, 10/07/2026 - 17:57 Aviso Affected Resources SenNet Datalogger Serie 200 V7.0m-1.53h. Description INCIBE has coordinated the publication of a high severity vulnerability affecting SenNet Datalogger Serie 200 by Satel Iberia, hardware for monitoring and controlling commercial and industrial buildings. The vulnerability was discovered by rijndael86. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS…
EPSS 0.00 CVSS 7.1 CVE-2026-5703 Satel Iberia ES
View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed according to the cybersecurity requirements, threat landscape, and industry practices that existed at the time of their release. As cybersecurity threats and security expectations have evolved, these end-of-life…
EPSS 0.81 CVSS 9.1 CVE-2010-2965 CVE-2014-9195 CVE-2023-46143 CVE-2026-8065 CVE-2026-8066 CVE-2026-8067 Hitachi Energy Wind River energetika US FI
View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-2026-15340) CVSS Vendor Equipment v3 9.8 Savannah lwIP SMTP client 1 Vulnerability Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Background Critical Infrastructure Sectors: Energy, Water and Wastewater Systems…
EPSS 0.00 CVE-2026-15340 Savannah energetika vodárenství US
View CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy SOI are affected: SOI vers:SOI/>=2.0.0|<=2.2.0 (CVE…
KEV ✓ EPSS 0.98 CVE-2026-34197 Hitachi Energy Apache energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG firmware <=2.0b52 (CVE-2026-27872, CVE-2026-27873) CVSS Vendor Equipment v3 7.7 Johnson Controls EasyIO FG firmware 2 Vulnerabilities Use of Hard-coded Credentials, Improper Privilege Management Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial…
EPSS 0.00 CVE-2026-27872 CVE-2026-27873 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy Asset Suite are affected: Asset Suite vers:Asset_Suite/<=9.9.0 (CVE-2026…
EPSS 0.00 CVE-2026-11796 CVE-2026-7395 Hitachi Energy energetika US
View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy REB500 are affected: REB500 vers:REB500/<=8.3.3.1 (CVE-2024-8176, CVE-2025-59375) CVSS Vendor Equipment v3 6.5…
EPSS 0.01 CVE-2024-8176 CVE-2025-59375 Hitachi Energy energetika US
[VDE-2026-108] The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for the LNI 4.0 testbed demonstrator. Its REST API is bound to all network interfaces on TCP port 18000, requires no authentication and accepts cross-origin requests from any origin. The reference implementation was never intended for productive use and is no longer maintained. Affected are all aas-edge-client versions.
EPSS 0.00 CVE-2026-94293 Murrelektronik výroba a průmysl DE
Serial Number: AV26-998 Date: October 5, 2026 As of October 2, 2026, GeoVision Inc. is affected by vulnerabilities in the following product: GV-Eye Versions prior to V3.6.0 Android The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GeoVision Security Advisory (PDF) Cyber Security - GeoVision
GeoVision CA
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-86325, CVE-2026-86326, Summary: CVE-2026-86325 CVSS 4.0: 9.4 - AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as…
EPSS 0.00 CVSS 9.4 CVE-2026-86325 CVE-2026-86326 Moxa FI CA FR
Serial Number: AV26-993 Date: October 2, 2026 As of October 1, 2026, Hitachi is affected by vulnerabilities in the following product: Hitachi Coding Software Suite Prior to V4.0.0 or later The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Information Regarding Reported Vulnerabilities in Hitachi Coding Software Suite (HCSS) Security Information ID: hitachi-sec-2026-001 (PDF) Hitachi Vulnerability…
Hitachi CA
Serial number: AV26-991 Date: October 2, 2026 As of October 1, 2026, Johnson Controls is affected by vulnerabilities in the following products: Easy IO FG Prior to 2.0b52 Easy IO Neo Prior to 3.3b63 Prior to 3.3b25 EasyIO FS32 Prior to 3.0b63 Prior to 3.3b63 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Johnson Controls - Product Security Advisories
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-90443, CVE-2026-90444, CVE-2026-90445, CVE-2026-90446, CVE-2026-90447, CVE-2026-90448, CVE-2026-90449, CVE-2026-90450, CVE-2026-90451, CVE-2026-90452, CVE-2026-90453, CVE-2026-90454, CVE-2026-90455, CVE-2026-90456, CVE-2026-90457, CVE-2026-101104, CVE-2026-96613, CVE-2026-64892, CVE-2026-15952, CVE-2026-15953 (+9 other associated CVEs), Summary: CISA released six Industrial Control…
CVSS 9.8 ABB Johnson Controls Monta Armatura LLC FI
Serial number: AV26-983 Date: October 1, 2026 As of September 30, 2026, CODESYS is affected by vulnerabilities in the following products: CODESYS Control RTE (SL) Prior to 3.5.22.40 CODESYS Control RTE (for Beckhoff CX) SL Prior to 3.5.22.40 CODESYS Control Win (SL) Prior to 3.5.22.40 CODESYS Control for BeagleBone SL Prior to 4.23.0.0 CODESYS Control for IOT2000 SL Prior to 4.23.0.0 CODESYS Control for Linux ARM SL Prior to 4.23.0.0 CODESYS Control for Linux SL Prior to 4.23.0.0 CODESYS…
CODESYS CA
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)…
EPSS 0.00 CVSS 5.4 CVE-2026-64893 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. The following versions of ABB Protection and Control IED Manager PCM600 are affected: Protection and Control IED Manager PCM600 <=2.14 (CVE-2026-15952, CVE-2026-15953) CVSS Vendor Equipment Vulnerabilities v3 6.4 ABB ABB Protection and Control IED Manager PCM600 Incorrect Permission Assignment for Critical Resource, Improper Limitation of a Pathname to a…
EPSS 0.00 CVSS 6.4 CVE-2026-15952 CVE-2026-15953 ABB energetika US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892) EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892) EasyIO Neo Series CW Controllers…
EPSS 0.00 CVSS 3.5 CVE-2026-64892 Johnson Controls výroba a průmysl veřejná správa doprava energetika US
View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. The following versions of Monta monta.app are affected: monta.app vers:all/* (CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, CVE-2026-93474) CVSS Vendor Equipment Vulnerabilities v3 9.4 Monta Monta monta.app Missing Authentication for Critical Function, Improper…
EPSS 0.00 CVSS 9.4 CVE-2026-93474 CVE-2026-95102 CVE-2026-97212 CVE-2026-97363 Monta energetika doprava US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026…
KEV ✓ · ransomware EPSS 1.00 CVSS 9.8 CVE-2023-46604 CVE-2026-94591 CVE-2026-94592 CVE-2026-94593 CVE-2026-94594 Armatura LLC Apache telekomunikace výroba a průmysl energetika doprava US
[VDE-2025-102] Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach files elsewhere in the file system.
EPSS 0.01 CVE-2025-41753 WAGO DE
[VDE-2025-081] Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are
EPSS 0.00 CVE-2025-41700 CVE-2025-41738 CVE-2025-41739 WAGO CODESYS DE
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-77185, CVE-2026-93994, CVE-2026-93995, CVE-2026-93996, CVE-2026-94002, CVE-2026-94053, CVE-2026-94029, CVE-2026-94052, CVE-2026-102509, CVE-2026-102510, CVE-2026-102511, CVE-2026-102508, Summary: CVE-2026-77185 (CVSS:9.1): Apache MINA SSHD: Asynchronous authentication can bypass signature verification CVE-2026-93994 (CVSS:8.1): Apache MINA SSHD: Repeated-publickey policy bypass on…
EPSS 0.00 CVSS 9.2 CVE-2026-102508 CVE-2026-102509 CVE-2026-102510 CVE-2026-102511 CVE-2026-77185 CVE-2026-93994 CVE-2026-93995 CVE-2026-93996 CVE-2026-94002 CVE-2026-94029 CVE-2026-94052 CVE-2026-94053 Apache FI
[Advisory2026-11_VDE-2026-094] The CODESYS Gateway Client (CmpGatewayClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.
EPSS 0.00 CVE-2026-76992 CODESYS DE
[Advisory2026-12_VDE-2026-097] The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs. Due to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. PLCs based on the CODESYS Runtime…
EPSS 0.00 CVE-2026-79625 CODESYS DE
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0, CVEs: CVE-2026-94204, CVE-2026-96587, CVE-2026-84411, CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295, CVE-2026-100296, CVE-2026-100297, CVE-2026-100298, CVE-2026-100299, CVE-2026-96274, CVE-2026-22755, CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068 (+6 other associated CVEs), Summary: CISA released seven Industrial…
Serial number: AV26-975Date: September 29, 2026 As of September 29, 2026, Hitachi Energy is affected by vulnerabilities in the following product: RTU500 series CMU firmware Prior to 12.7.8, 13.9.1 or later The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerabilities in Hitachi Energy RTU500 End-of-Life versions (PDF) Hitachi Vulnerability Information
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges. The following versions of Lantronix G520 Series Cellular Gateway are affected: G520 Series 2.6.0.4R6_stable (CVE-2026-84409, CVE-2026-91191) CVSS Vendor Equipment Vulnerabilities v3 7.5 Lantronix Lantronix G520 Series Cellular Gateway Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper…
EPSS 0.00 CVSS 7.5 CVE-2026-84409 CVE-2026-91191 Lantronix doprava energetika vodárenství US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following versions of Toptech TMS7 and TopHAT are affected: TMS7 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) TopHAT 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026…
EPSS 0.00 CVSS 10.0 CVE-2026-63713 CVE-2026-68068 CVE-2026-68954 CVE-2026-69662 CVE-2026-70356 CVE-2026-71189 CVE-2026-71302 CVE-2026-71379 CVE-2026-72507 CVE-2026-72510 Toptech Systems energetika doprava US
View CSAF Summary Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. The following versions of VIVOTEK Camera Firmware are affected: V Series model_FD9187 (CVE-2026-22755) V Series model_FD9189 (CVE-2026-22755) V Series model_FD9365 (CVE-2026-22755) V Series model_FD9387 (CVE-2026-22755) V Series model_FD9389 (CVE-2026-22755) V Series model…
EPSS 0.14 CVSS 10.0 CVE-2026-22755 VIVOTEK US
CERT Polska has received a report about 7 vulnerabilities (from CVE-2026-82928 to CVE-2026-82930 and CVE-2026-82932, CVE-2026-82933, CVE-2026-82935 and CVE-2026-82936) found in F&F Filipowski mH-DEVELOPER devices.
EPSS 0.00 CVE-2026-82928 CVE-2026-82930 CVE-2026-82932 CVE-2026-82933 CVE-2026-82935 CVE-2026-82936 F&F Filipowski PL
View CSAF Summary This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute. The following versions of Siemens Mendix Runtime are affected: Siemens Mendix Runtime vers:all/* (CVE-2026-7891) CVSS Vendor Equipment Vulnerabilities v3 9.1 Siemens Siemens Mendix Runtime Insecure Inherited Permissions Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide…
CVSS 9.1 CVE-2026-7891 Siemens výroba a průmysl US
Introduction The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators. ICS is an umbrella term referring to integrated networks of hardware and software designed to monitor and automate…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. The following versions of lwIP TCP/IP Stack MQTT Client Application are affected: MQTT Client Application >=2.0.1|<=2.2.1 (CVE-2026-87121) CVSS Vendor Equipment Vulnerabilities v3 9.8 lwIP lwIP TCP/IP Stack MQTT Client Application Out-of-bounds Write Background Critical Infrastructure Sectors: Chemical, Communications, Critical Manufacturing, Energy, Financial…
EPSS 0.01 CVSS 9.8 CVE-2026-87121 lwIP telekomunikace výroba a průmysl energetika finance US
View CSAF Summary A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access on the OIS server. Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.…
EPSS 0.00 CVSS 9.0 CVE-2026-50093 Siemens výroba a průmysl telekomunikace US
View CSAF Summary SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SIMOVE Fleetmanager and SIPLANT are affected: SIMOVE Fleetmanager V3.1 vers:intdot/<3.1.13 (CVE-2026-67367) SIMOVE Fleetmanager V3.2 vers:intdot/<3.2.4 (CVE-2026-67367) SIMOVE Fleetmanager V3.3…
EPSS 0.01 CVSS 8.6 CVE-2026-67367 Siemens výroba a průmysl US
View CSAF Summary A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization. The…
EPSS 0.00 CVSS 8.2 CVE-2026-34223 Siemens výroba a průmysl US
View CSAF Summary Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens SIPLUS and SIMATIC Products are affected: SIMATIC AX Runtime Core Linux Common Debian vers:all/* (CVE-2026-31431) SIMATIC…
KEV ✓ EPSS 0.98 CVSS 7.8 CVE-2026-31431 Siemens ABB Linux výroba a průmysl energetika vodárenství US EU AT HU
View CSAF Summary The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens WTV676 and WTV776 are affected: WTV676-HB6035 Web Interface vers:intdot/<3.94 (CVE-2026-89207)…
EPSS 0.00 CVSS 6.5 CVE-2026-89207 Siemens energetika US IT
View CSAF Summary Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system. The following versions of lwIP (Lightweight IP) are affected: API >=2.0.1|<=2.2.1 (CVE-2026-91018) CVSS Vendor Equipment Vulnerabilities v3 8.8 lwIP lwIP (Lightweight IP) Double Free Background Critical Infrastructure Sectors: Chemical, Communications, Critical Manufacturing, Energy, Financial Services, Healthcare…
EPSS 0.00 CVSS 8.8 CVE-2026-91018 lwIP energetika vodárenství telekomunikace doprava US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives. The following versions of OpenPLC Runtime v3 are affected: OpenPLC 3 (CVE-2026-88020) CVSS Vendor Equipment Vulnerabilities v3 6.1 Autonomy Logic OpenPLC Runtime v3 Improper Neutralization of Input During Web Page…
EPSS 0.00 CVSS 6.1 CVE-2026-88020 Autonomy Logic výroba a průmysl energetika doprava vodárenství US
View CSAF Summary Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Industrial Edge Management are affected: Industrial Edge Management Cloud vers:all/* (CVE-2026-18963)…
EPSS 0.05 CVSS 9.1 CVE-2026-18963 Siemens Red Hat Oracle Jackson výroba a průmysl US NL FI
[VDE-2026-089] The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.
EPSS 0.01 CVSS 9.6 CVE-2026-75925 Lenze IXON výroba a průmysl energetika vodárenství DE US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.8, CVEs: CVE-2026-15579, Summary: Moxa has disclosed an out-of-bounds write vulnerability in the Web login functionality of TN-4500B Series Ethernet switches. The vulnerability can be exploited remotely without authentication by supplying an overly long username, potentially causing a buffer overflow and denial of service. Moxa has released firmware 2.1, which addresses the vulnerability. Affected…
EPSS 0.01 CVSS 8.8 CVE-2026-15579 Moxa FI CA FR
Serial number: AV26-942Date: September 18, 2026 As of September 18, 2026, ABB published a security advisory to address vulnerabilities in the following product: Freelance Controller Multiple versions and models The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Freelance SECURITY - Missing Length Check CVE ID: CVE-2023-5778 ABB Cyber security alerts and notifications
EPSS 0.00 CVE-2023-5778 ABB CA
Serial number: AV26-937Date: September 18, 2026 As of September 4, 2026, Advantech is affected by vulnerabilities in the following products: EKI-1242EIMS Prior to or equal to V2.00.01 EKI-1242IEIMS Prior to or equal to V2.00.01 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerabilities Identified in EKI-1242EIMS/EKI-1242IEIMS (PDF) Advantech Security Advisories
Advantech CA
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.0: 9.9, CVEs: CVE-2026-13348, CVE-2026-31431, CVE-2026-13336, CVE-2026-13337, CVE-2025-6625, CVE-2024-4872, CVE-2024-3980, CVE-2024-3982, CVE-2024-7940, CVE-2024-7941, CVE-2026-15688, CVE-2026-86520, CVE-2026-86689, CVE-2026-77960, CVE-2026-13584, Summary: CISA released eight Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues,…
KEV ✓ EPSS 0.98 CVSS 9.9 CVE-2024-3980 CVE-2024-3982 CVE-2024-4872 CVE-2024-7940 CVE-2024-7941 CVE-2025-6625 CVE-2026-13336 CVE-2026-13337 CVE-2026-13348 CVE-2026-13584 CVE-2026-15688 CVE-2026-31431 CVE-2026-77960 CVE-2026-86520 CVE-2026-86689 Bransys Mitsubishi Electric Hitachi Energy Schneider Electric FI
View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to apply the remediation provided below may risk improper authentication validation which could result in disruption of operations and access to system data. The following versions of Schneider Electric…
EPSS 0.01 CVSS 5.3 CVE-2026-13348 Schneider Electric energetika výroba a průmysl US
View CSAF Summary Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H https://www.se.com/us/en/product/BMXNOR0200H/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-environments/: Modicon M340 X80 Ethernet Communication Modules, BMXNGD0100 https://www.se.com/us/en/product/BMXNGD0100/communication-module-modicon-m580-global-data-service/: M580 Global Data module, BMXNOC0401 https://www.se…
EPSS 0.00 CVSS 7.5 CVE-2025-6625 Schneider Electric energetika vodárenství výroba a průmysl US
View CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to apply the remediation provided below may risk arbitrary or remote code execution over the local network, which could result in device manipulation and unauthorized data access. The following versions…
EPSS 0.02 CVSS 6.4 CVE-2026-13336 CVE-2026-13337 Schneider Electric výroba a průmysl US
View CSAF Summary Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. The following versions of Bransys ELD are affected: Android <11.00.00 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960) iOS <1.1.54 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960) CVSS Vendor Equipment Vulnerabilities v3 7.5 Bransys Bransys ELD Use of Hard-coded Credentials, Cleartext Transmission of Sensitive Information Background Critical Infrastructure Sectors:…
EPSS 0.00 CVSS 7.5 CVE-2026-77960 CVE-2026-86520 CVE-2026-86689 Bransys doprava US