156 articles
OT / SCADAA pre-authentication integer underflow in MikroTik RouterOS WebFig allows unauthenticated network attackers to achieve remote code execution as root.
OT / SCADAA critical OS command injection vulnerability in Johnson Controls EasyIO FS32 controllers allows network attackers to gain root access and hijack HVAC control logic.
Threat IntelCISA advisories ICSA-26-274-04 and ICSA-26-274-05 warn of cleartext credential and session disclosure in Johnson Controls EasyIO Neo building controllers.
Threat IntelHardcoded passwords in Teledyne FLIR Aware2 software expose PackBot and FirstLook tactical EOD and defense robots to remote unauthenticated takeover.
Threat IntelCISA advisory ICSA-26-274-02 details critical authentication and rate-limiting flaws in Monta EV charging platform WebSocket APIs, enabling charger hijacking.
OT / SCADACISA advisory ICSA-26-274-03 reveals local SYSTEM privilege escalation and project archive path traversal in ABB Protection and Control IED Manager PCM600.
OT / SCADACISA advisory ICSA-26-274-01 warns of embedded ActiveMQ deserialization and hardcoded AES keys in Armatura One, enabling physical security facility takeover.
OT / SCADACISA advisory ICSA-26-272-05 exposes critical unauthenticated command injection and credential disclosure vulnerabilities across Anjvision streaming transcoders.
Threat IntelA critical stack-based buffer overflow in Tenda GPON optical terminals allows unauthenticated remote attackers on the WAN interface to achieve root command execution.
Threat IntelAn authentication bypass and SQL injection in ground-station before v0.8.0 allows remote attackers to plant admin accounts and seize telemetry consoles.
OT / SCADAUndocumented backdoor maintenance accounts and hardcoded credentials in Hitachi Coding Software Suite through v3.3.0 permit unauthorized full system access.
OT / SCADAA hardcoded JWT signing key in Hitachi Coding Software Suite through v3.3.0 allows unauthenticated attackers to forge admin tokens and hijack factory lines.
Threat IntelCISA advisory ICSA-26-272-04 warns that malformed RF uplink packets in Baicells Nova 430H private LTE base stations cause remote denial-of-service.
Threat IntelA critical format string vulnerability in ASUS gateway router web modules allows authenticated attackers to execute arbitrary code with root privileges.
Threat IntelA missing authentication flaw in PTZOptics cameras and Firmware Upgrade Tools allows unauthenticated attackers to flash malicious firmware remotely.
Threat IntelCISA issues ICSA-26-272-03 warning of a critical command injection flaw in VIVOTEK industrial camera firmware enabling physical security stream hijacking.
Threat IntelCISA advisory ICSA-26-272-01 reveals unencrypted update conduits and hardcoded private signing keys in Lantronix G520 gateways, enabling root RCE.
Threat IntelCISA advisory ICSA-26-272-02 exposes critical flaws in Toptech TMS7 and TopHAT, enabling remote unauthenticated attackers to hijack oil and gas loading racks.
OT / SCADAOriginal OT research examining deterministic Industrial Ethernet fieldbus vulnerabilities under IEC 62443, demonstrating microsecond packet injection risks.
OT / SCADACISA Advisory ICSA-26-211-07 warns of a high-severity protocol command manipulation flaw in Mitsubishi Electric CC-Link IE TSN industrial communication modules.
OT / SCADACISA Advisory ICSA-26-242-01 warns of a critical unauthenticated remote code execution vulnerability in Rockwell Automation FactoryTalk View SE.
OT / SCADACISA Advisory ICSA-26-265-07 details a high-severity path traversal vulnerability in Siemens SIMOVE Fleetmanager allowing unauthenticated arbitrary file exfiltration.
OT / SCADACISA Advisory ICSA-26-240-02 warns of a critical heap-based buffer overflow in Schneider Electric EcoStruxure Operator Terminal Expert enabling remote code execution.
OT / SCADAA technical engineering guide on implementing IEC 62443-3-2 Zones and Conduits to isolate critical PLC and SCADA assets against cyberattacks.