# iava_bulletins

iava_id: /node/24639
title: Siemens RUGGEDCOM APE1808 Devices
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-02
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-02.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.</strong></p>
  <p>The following versions of Siemens RUGGEDCOM APE1808 Devices are affected:</p>
  <ul>
  <li>RUGGEDCOM APE1808 vers:all/*, vers:all/* (CVE-2026-24858, CVE-2025-55018, CVE-2025-62439, CVE-2025-64157)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.8</td>
  <td>Siemens</td>
  <td>Siemens RUGGEDCOM APE1808 Devices</td>
  <td>Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Improper Verification of Source of a Communication Channel, Use of Externally-Controlled Format String, Authentication Bypass Using an Alternate Path or Channel</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Germany</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-55018</a></h3>
  <div class="csaf-accordion-content">
  <p>An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-55018">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens RUGGEDCOM APE1808 Devices</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RUGGEDCOM APE1808</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update Fortigate NGFW to V7.4.10 or later version. Contact customer support to receive patch and update information.</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in HTML https://cert-portal.siemens.com/productcert/html/ssa-975644.html</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-975644.json</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/444.html">CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.8</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-62439</a></h3>
  <div class="csaf-accordion-content">
  <p>An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-62439">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens RUGGEDCOM APE1808 Devices</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RUGGEDCOM APE1808</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update Fortigate NGFW to V7.4.10 or later version with FSSO TS Agent version 5.0 build 0324 or later version. Contact customer support to receive patch and update information.</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in HTML https://cert-portal.siemens.com/productcert/html/ssa-975644.html</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-975644.json</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/940.html">CWE-940 Improper Verification of Source of a Communication Channel</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.2</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-64157</a></h3>
  <div class="csaf-accordion-content">
  <p>A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-64157">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens RUGGEDCOM APE1808 Devices</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RUGGEDCOM APE1808</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update Fortigate NGFW to V7.4.10 or later version. Contact customer support to receive patch and update information.</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in HTML https://cert-portal.siemens.com/productcert/html/ssa-975644.html</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-975644.json</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/134.html">CWE-134 Use of Externally-Controlled Format String</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.7</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24858</a></h3>
  <div class="csaf-accordion-content">
  <p>An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24858">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens RUGGEDCOM APE1808 Devices</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RUGGEDCOM APE1808</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update Fortigate NGFW to V7.4.11 or later version. Contact customer support to receive patch and update information.</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in HTML https://cert-portal.siemens.com/productcert/html/ssa-975644.html</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Siemens security advisory SSA-975644 in CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-975644.json</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/288.html">CWE-288 Authentication Bypass Using an Alternate Path or Channel</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Siemens reported these vulnerabilities to CISA.</li>
  </ul>
  <hr>
  <h2>General Recommendations</h2>
  <p>As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity</p>
  <hr>
  <h2>Additional Resources</h2>
  <p>For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories</p>
  <hr>
  <h2>Terms of Use</h2>
  <p>The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Siemens ProductCERT SSA-975644 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Publication Date</td>
  </tr>
  <tr>
  <td>2026-03-12</td>
  <td>2</td>
  <td>Initial CISA Republication of Siemens ProductCERT SSA-975644 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24641
title: Siemens SIMATIC
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-04
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-04.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>SIMATIC S7-1500 devices contain a vulnerability that could allow an attacker to inject code by tricking a legitimate user into importing a specially crafted trace file in the web interface. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</strong></p>
  <p>The following versions of Siemens SIMATIC are affected:</p>
  <ul>
  <li>SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V2 CPUs - Windows OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V3 CPUs - Industrial OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V3 CPUs - Windows OS vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RM03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517H-4 PN (6ES7517-4HQ10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518-3 PN (6ES7518-3AT10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518F-3 PN (6ES7518-3FT10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JT10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518T-3 PN (6ES7518-3TT10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518TF-3 PN (6ES7518-3UT10-0AB0) vers:intdot/&lt;4.1.2 (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S F V2 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S F V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S F V4 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S V2 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1507S V4 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S F V2 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S F V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S F V4 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S T V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S TF V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S V2 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller CPU 1508S V4 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller Linux V2 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-1500 Software Controller Linux V3 vers:all/* (CVE-2025-40943)</li>
  <li>SIMATIC S7-PLCSIM Advanced vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0) vers:all/* (CVE-2025-40943)</li>
  <li>SIPLUS S7-1500 CPU 1518HF-4 PN (6AG1518-4JP00-4AB0) vers:all/* (CVE-2025-40943)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.6</td>
  <td>Siemens</td>
  <td>Siemens SIMATIC</td>
  <td>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Germany</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-40943</a></h3>
  <div class="csaf-accordion-content">
  <p>Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering a legitimate user to import a specially crafted trace file</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-40943">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIMATIC</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0), SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0), SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0), SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0), SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0), SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0), SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0), SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0), SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0), SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0), SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0), SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V2 CPUs - Windows OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V3 CPUs - Industrial OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC3 (incl. SIPLUS variants) V3 CPUs - Windows OS, SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0), SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0), SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0), SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0), SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0), SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0), SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0), SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0), SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0), SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0), SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0), SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0), SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0), SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0), SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0), SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0), SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0), SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0), SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0), SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0), SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0), SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0), SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0), SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RM03-0AB0), SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0), SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0), SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0), SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0), SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0), SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0), SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0), SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RN03-0AB0), SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0), SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0), SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0), SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0), SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0), SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0), SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0), SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0), SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0), SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0), SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0), SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0), SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0), SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0), SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0), SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0), SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0), SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0), SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0), SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0), SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0), SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0), SIMATIC S7-1500 CPU 1517H-4 PN (6ES7517-4HQ10-0AB0), SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0), SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0), SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0), SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0), SIMATIC S7-1500 CPU 1518-3 PN (6ES7518-3AT10-0AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-3 PN (6ES7518-3FT10-0AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0), SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0), SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JT10-0AB0), SIMATIC S7-1500 CPU 1518T-3 PN (6ES7518-3TT10-0AB0), SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0), SIMATIC S7-1500 CPU 1518TF-3 PN (6ES7518-3UT10-0AB0), SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0), SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0), SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0), SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0), SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0), SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0), SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0), SIMATIC S7-1500 Software Controller CPU 1507S F V2, SIMATIC S7-1500 Software Controller CPU 1507S F V3, SIMATIC S7-1500 Software Controller CPU 1507S F V4, SIMATIC S7-1500 Software Controller CPU 1507S V2, SIMATIC S7-1500 Software Controller CPU 1507S V3, SIMATIC S7-1500 Software Controller CPU 1507S V4, SIMATIC S7-1500 Software Controller CPU 1508S F V2, SIMATIC S7-1500 Software Controller CPU 1508S F V3, SIMATIC S7-1500 Software Controller CPU 1508S F V4, SIMATIC S7-1500 Software Controller CPU 1508S T V3, SIMATIC S7-1500 Software Controller CPU 1508S TF V3, SIMATIC S7-1500 Software Controller CPU 1508S V2, SIMATIC S7-1500 Software Controller CPU 1508S V3, SIMATIC S7-1500 Software Controller CPU 1508S V4, SIMATIC S7-1500 Software Controller Linux V2, SIMATIC S7-1500 Software Controller Linux V3, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0), SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0), SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0), SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0), SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0), SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0), SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0), SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0), SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0), SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0), SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0), SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0), SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0), SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0), SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0), SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0), SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0), SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0), SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0), SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0), SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0), SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0), SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0), SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0), SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0), SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0), SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0), SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0), SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0), SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0), SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0), SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0), SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0), SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0), SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0), SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0), SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0), SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0), SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0), SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0), SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0), SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0), SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0), SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0), SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0), SIPLUS S7-1500 CPU 1518HF-4 PN (6AG1518-4JP00-4AB0)</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Disable the webserver if not required on the affected systems. Restrict the access to Port 80/tcp and 443/tcp to trusted IP address only</p>
  <p><strong>Mitigation</strong><br>Only upload trusted trace files</p>
  <p><strong>None available</strong><br>Currently no fix is available</p>
  <p><strong>Vendor fix</strong><br>Update to V4.1.2 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.6</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Siemens ProductCERT reported this vulnerability to CISA.</li>
  </ul>
  <hr>
  <h2>General Recommendations</h2>
  <p>As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity</p>
  <hr>
  <h2>Additional Resources</h2>
  <p>For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories</p>
  <hr>
  <h2>Terms of Use</h2>
  <p>The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Siemens ProductCERT SSA-452276 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Publication Date</td>
  </tr>
  <tr>
  <td>2026-03-12</td>
  <td>2</td>
  <td>Initial CISA Republication of Siemens ProductCERT SSA-452276 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24638
title: Trane Tracer SC, Tracer SC+, and Tracer Concierge
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product.</strong></p>
  <p>The following versions of Trane Tracer SC, Tracer SC+, and Tracer Concierge are affected:</p>
  <ul>
  <li>Tracer SC</li>
  <li>Tracer SC+</li>
  <li>Tracer Concierge</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 8.1</td>
  <td>Trane</td>
  <td>Trane Tracer SC, Tracer SC+, and Tracer Concierge</td>
  <td>Use of a Broken or Risky Cryptographic Algorithm, Memory Allocation with Excessive Size Value, Missing Authorization, Use of Hard-coded Credentials, Use of Hard-coded, Security-relevant Constants</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Ireland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-28252</a></h3>
  <div class="csaf-accordion-content">
  <p>A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-28252">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Trane Tracer SC, Tracer SC+, and Tracer Concierge</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Trane</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Trane Tracer SC: &lt;v4.4_SP7, Trane Tracer SC+: &lt;v6.3.2310, Trane Tracer Concierge: &lt;v6.3.2310</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Trane has released the following versions of Tracer SC+ for users to upgrade to:</p>
  <p><strong>Vendor fix</strong><br>CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/327.html">CWE-327 Use of a Broken or Risky Cryptographic Algorithm</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.0</td>
  <td>8.1</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-28253</a></h3>
  <div class="csaf-accordion-content">
  <p>A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-28253">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Trane Tracer SC, Tracer SC+, and Tracer Concierge</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Trane</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Trane Tracer SC: &lt;v4.4_SP7, Trane Tracer SC+: &lt;v6.3.2310, Trane Tracer Concierge: &lt;v6.3.2310</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Trane has released the following versions of Tracer SC+ for users to upgrade to:</p>
  <p><strong>Vendor fix</strong><br>CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/789.html">CWE-789 Memory Allocation with Excessive Size Value</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.0</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-28254</a></h3>
  <div class="csaf-accordion-content">
  <p>A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-28254">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Trane Tracer SC, Tracer SC+, and Tracer Concierge</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Trane</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Trane Tracer SC: &lt;v4.4_SP7, Trane Tracer SC+: &lt;v6.3.2310, Trane Tracer Concierge: &lt;v6.3.2310</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Trane has released the following versions of Tracer SC+ for users to upgrade to:</p>
  <p><strong>Vendor fix</strong><br>CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/862.html">CWE-862 Missing Authorization</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.0</td>
  <td>5.8</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-28255</a></h3>
  <div class="csaf-accordion-content">
  <p>A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-28255">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Trane Tracer SC, Tracer SC+, and Tracer Concierge</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Trane</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Trane Tracer SC: &lt;v4.4_SP7, Trane Tracer SC+: &lt;v6.3.2310, Trane Tracer Concierge: &lt;v6.3.2310</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Trane has released the following versions of Tracer SC+ for users to upgrade to:</p>
  <p><strong>Mitigation</strong><br>CVE-2026-28255: Trane has implemented enhanced cloud security controls to mitigate this vulnerability.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798 Use of Hard-coded Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.8</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-28256</a></h3>
  <div class="csaf-accordion-content">
  <p>A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-28256">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Trane Tracer SC, Tracer SC+, and Tracer Concierge</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Trane</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Trane Tracer SC: &lt;v4.4_SP7, Trane Tracer SC+: &lt;v6.3.2310, Trane Tracer Concierge: &lt;v6.3.2310</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Trane has released the following versions of Tracer SC+ for users to upgrade to:</p>
  <p><strong>Mitigation</strong><br>CVE-2026-28256: Trane has implemented enhanced security controls which have been communicated to their customers. For more information, contact Trane.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/547.html">CWE-547 Use of Hard-coded, Security-relevant Constants</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.8</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Noam Moshe of Claroty reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-12</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-12</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24642
title: Siemens Heliox EV Chargers
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-05
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-05.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Heliox EV Chargers listed below contain improper access control vulnerability that could allow an attacker to reach unauthorized services via the charging cable. Siemens has released new versions for the affected products and recommends to update to the latest versions.</strong></p>
  <p>The following versions of Siemens Heliox EV Chargers are affected:</p>
  <ul>
  <li>Heliox Flex 180 kW EV Charging Station</li>
  <li>Heliox Mobile DC 40 kW EV Charging Station</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 2.6</td>
  <td>Siemens</td>
  <td>Siemens Heliox EV Chargers</td>
  <td>Improper Restriction of Communication Channel to Intended Endpoints</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Germany</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-27769</a></h3>
  <div class="csaf-accordion-content">
  <p>Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-27769">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens Heliox EV Chargers</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Heliox Flex 180 kW EV Charging Station, Heliox Mobile DC 40 kW EV Charging Station</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Contact customer support for patch information via OTA update</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/923.html">CWE-923 Improper Restriction of Communication Channel to Intended Endpoints</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>2.6</td>
  <td>LOW</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N">CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Siemens ProductCERT reported this vulnerability to CISA.</li>
  </ul>
  <hr>
  <h2>General Recommendations</h2>
  <p>As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity</p>
  <hr>
  <h2>Additional Resources</h2>
  <p>For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories</p>
  <hr>
  <h2>Terms of Use</h2>
  <p>The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Siemens ProductCERT SSA-126399 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Publication Date</td>
  </tr>
  <tr>
  <td>2026-03-12</td>
  <td>2</td>
  <td>Initial CISA Republication of Siemens ProductCERT SSA-126399 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24643
title: Inductive Automation Ignition Software
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-06
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-06.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could allow an attacker to execute malicious code with OS application service account permissions that the authenticated, privileged application user did not intend on running.</strong></p>
  <p>The following versions of Inductive Automation Ignition Software are affected:</p>
  <ul>
  <li>Ignition Software &lt;8.3.0 (CVE-2025-13913)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 6.3</td>
  <td>Inductive Automation</td>
  <td>Inductive Automation Ignition Software</td>
  <td>Deserialization of Untrusted Data</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Information Technology</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-13913</a></h3>
  <div class="csaf-accordion-content">
  <p>A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code during deserialization.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-13913">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Inductive Automation Ignition Software</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Inductive Automation</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Inductive Automation Ignition Software: &lt;8.3.0</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Fix - upgrade Ignition software from 8.1.x to 8.3.0 or greater.</p>
  <p><strong>Mitigation</strong><br>MITIGATION (8.1.x Linux). Implement Ignition Security Hardening Guide Appendix A. https://inductiveautomation.com/resources/article/ignition-security-hardening-guide</p>
  <p><strong>Mitigation</strong><br>MITIGATION (8.1.x Windows). Covered in Ignition Security Hardening Guide Appendix A. 1. Create a new dedicated local Windows account that will be used exclusively for the Ignition service (e.g. svc-ign). a. The best security practice is that the Ignition service should not be a domain account (unless otherwise needed). b. Remove all group memberships from the service account (including Users and Administrators). c. Add to security policy to log in as a service. d. Add to "Deny log on locally" security policy. 2. Provide full read/write access only to the Ignition installation directory for the service account created in #1. a. Add read/write permissions to other directories in the local filesystem as needed (e.g.: if configured to use optional Enterprise Administration Module to write automated backups to the file system). 3. Set deny access settings for service account on other directories not needed by the Ignition service. a. Specifically the C:\Windows, C:\Users, and directories for any other applications in the Program Files or Program Files(x86) directories. b. Use java param to change temp directory to a location within the Ignition install directory so the Users folder can be denied access to the Ignition service account.</p>
  <p><strong>Mitigation</strong><br>BEST PRACTICES (8.1.x and 8.3.x)4. Restrict project imports to verified and trusted sources only, ideally using checksums or digital signatures.5. Use multiple environments (e.g. Dev, Test, Prod) with a staging workflow so that new data is never introduced directly to Production environments. See Ignition Deployment Best Practices.6. When feasible, segment or isolate Ignition gateways from corporate resources and Windows Domains.a. The Ignition service account or AD server object should never need Windows Domain or Windows Active Directory privileges. This would only be needed if an Asset Owners IT or OT department uses this for management outside Ignition.b. Ignition may be federated with Active Directory environments (e.g. OT domains) by entering "Authentication Profile" credentials within the Ignition gateway itself. This could use secure LDAP, SAML, or OpenID Connect.7. When feasible, enforce strong credential management and MFA for all users with Designer permissions (8.1.x and 8.3.x), Config Page permissions (8.1.x), and Config Write permissions (8.3.x).8. When feasible, deploy Ignition within hardened or containerized environments.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502 Deserialization of Untrusted Data</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Nik Tsytsarkin, Ismail Aydemir, and Ryan Hall of Meta reported this vulnerability to Inductive Automation</li>
  <li>Nathan Boeger and Joel Specht of Inductive Automation (security@inductiveautomation.com) reported this vulnerability to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-12</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-12</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24636
title: CISA Adds One Known Exploited Vulnerability to Catalog
release_date: Wed, 11 Mar 26 12:00:00 +0000
ingested_at: 2026-03-12 18:23:56
description:
  <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-68613" target="_blank">CVE-2025-68613</a> n8n Improper Control of Dynamically-Managed Code Resources Vulnerability</li>
  </ul>
  <p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">KEV Catalog vulnerabilities</a> as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities">specified criteria</a>.<br>&nbsp;</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/03/11/cisa-adds-one-known-exploited-vulnerability-catalog


iava_id: /node/24633
title: Honeywell IQ4x BMS Controller
release_date: Tue, 10 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could allow an unauthorized attacker to access controller management settings, control components, disclose information, or cause a denial-of-service condition.</strong></p>
  <p>The following versions of Honeywell IQ4x BMS Controller are affected:</p>
  <ul>
  <li>IQ4E &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQ412 &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQ422 &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQ4NC &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQ41x &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQ3 &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  <li>IQECO &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9 (CVE-2026-3611)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 10</td>
  <td>Honeywell</td>
  <td>Honeywell IQ4x BMS Controller</td>
  <td>Missing Authentication for Critical Function</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Commercial Facilities, Critical Manufacturing, Government Services and Facilities, Healthcare and Public Health</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-3611</a></h3>
  <div class="csaf-accordion-content">
  <p>The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-3611">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Honeywell IQ4x BMS Controller</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Honeywell</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Honeywell IQ4E: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQ412: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQ422: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQ4NC: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQ41x: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQ3: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9, Honeywell IQECO: &gt;=Firmware_v3.50_3.44|&lt;4.36_build_4.3.7.9</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Honeywell is aware of the issue, but has not released a fix. For more information, contact Honeywell directly. https://www.honeywell.com/us/en/contact.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>10</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Gjoko Krstic of Zero Science reported this vulnerability to Honeywell</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24634
title: Ceragon Siklu MultiHaul and EtherHaul Series
release_date: Tue, 10 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-04
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-04.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could result in arbitrary file upload to the target equipment.</strong></p>
  <p>The following versions of Ceragon Siklu MultiHaul and EtherHaul Series are affected:</p>
  <ul>
  <li>MultiHaul MH-B100-CCS</li>
  <li>MultiHaul MH-T200-CCC</li>
  <li>MultiHaul MH-T200-CNN</li>
  <li>MultiHaul MH-T201-CNN</li>
  <li>EtherHaul EH-8010FX</li>
  <li>EtherHaul EH-500TX</li>
  <li>EtherHaul EH-600TX</li>
  <li>EtherHaul EH-614TX</li>
  <li>EtherHaul EH-700TX</li>
  <li>EtherHaul EH-710TX</li>
  <li>EtherHaul EH-1200TX</li>
  <li>EtherHaul EH-1200FX</li>
  <li>EtherHaul EH-2200FX</li>
  <li>EtherHaul EH-2500FX</li>
  <li>EtherHaul EH-5500FD</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 5.3</td>
  <td>Ceragon</td>
  <td>Ceragon Siklu MultiHaul and EtherHaul Series</td>
  <td>Unrestricted Upload of File with Dangerous Type</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Communications</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Israel</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-57176</a></h3>
  <div class="csaf-accordion-content">
  <p>The rfpiped service on TCP port 555 in Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas allow unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-57176">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Ceragon Siklu MultiHaul and EtherHaul Series</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Ceragon</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Ceragon MultiHaul MH-B100-CCS: &lt;R2.4.0, Ceragon MultiHaul MH-T200-CCC: &lt;R2.4.0, Ceragon MultiHaul MH-T200-CNN: &lt;R2.4.0, Ceragon MultiHaul MH-T201-CNN: &lt;R2.4.0, Ceragon EtherHaul EH-8010FX: &lt;R10.8.1, Ceragon EtherHaul EH-500TX: &lt;R7.7.12, Ceragon EtherHaul EH-600TX: &lt;R7.7.12, Ceragon EtherHaul EH-614TX: &lt;R7.7.12, Ceragon EtherHaul EH-700TX: &lt;R7.7.12, Ceragon EtherHaul EH-710TX: &lt;R7.7.12, Ceragon EtherHaul EH-1200TX: &lt;R7.7.12, Ceragon EtherHaul EH-1200FX: &lt;R7.7.12, Ceragon EtherHaul EH-2200FX: &lt;R7.7.12, Ceragon EtherHaul EH-2500FX: &lt;R7.7.12, Ceragon EtherHaul EH-5500FD: &lt;R7.7.12</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Ceragon has released a software update for the affected models:</p>
  <p><strong>Vendor fix</strong><br>Affected users should install firmware version R2.4.0 for affected MultiHaul models.</p>
  <p><strong>Vendor fix</strong><br>Affected users should install firmware version R10.8.1 for the affected EH-8010FX model.</p>
  <p><strong>Vendor fix</strong><br>Affected users should install firmware version R7.7.12 for other affected EtherHaul models.</p>
  <p><strong>Mitigation</strong><br>Additionally Ceragon has provided the following security recommendations for mitigating the listed vulnerability. To prevent exposure, management access must follow standard operator security guidelines:</p>
  <p><strong>Mitigation</strong><br>Management IP addresses must use private subnets (RFC 1918)</p>
  <p><strong>Mitigation</strong><br>Management networks must be protected by: *-* Firewalls *-* Access Control Lists *-* Network Access Translation / Secure management domains</p>
  <p><strong>Mitigation</strong><br>Firewalls</p>
  <p><strong>Mitigation</strong><br>Access Control Lists</p>
  <p><strong>Mitigation</strong><br>Network Access Translation / Secure management domains</p>
  <p><strong>Mitigation</strong><br>Public exposure of management IP Addresses is not supported nor recommendedCeragon requests that affected users please verify that all affected radio units:</p>
  <p><strong>Mitigation</strong><br>Use private management IP addresses only</p>
  <p><strong>Mitigation</strong><br>Are placed behind internal security controls</p>
  <p><strong>Mitigation</strong><br>Follow your organization's authentication and access-control policies</p>
  <p><strong>Mitigation</strong><br>Please visit the Ceragon portal here: https://portal.ceragon.com/ (login required) for further information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/434.html">CWE-434 Unrestricted Upload of File with Dangerous Type</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>CISA discovered a public Proof of Concept (PoC) as authored by semaja22 and reported it to Ceragon</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies), such as:</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24631
title: Apeman Cameras
release_date: Tue, 10 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-01
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to take control of the device or view camera feeds.</strong></p>
  <p>The following versions of Apeman Cameras are affected:</p>
  <ul>
  <li>ID71 vers:all/* (CVE-2025-11126, CVE-2025-11851, CVE-2025-11852)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.8</td>
  <td>Apeman</td>
  <td>Apeman Cameras</td>
  <td>Insufficiently Protected Credentials, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Commercial Facilities</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>China</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-11126</a></h3>
  <div class="csaf-accordion-content">
  <p>A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-11126">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Apeman Cameras</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Apeman</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Apeman ID71: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Apeman did not respond to CISAs request for coordination. Users are encouraged to reach out to Apeman for support https://apemans.com/pages/contactus</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-11851</a></h3>
  <div class="csaf-accordion-content">
  <p>A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-11851">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Apeman Cameras</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Apeman</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Apeman ID71: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Apeman did not respond to CISAs request for coordination. Users are encouraged to reach out to Apeman for support https://apemans.com/pages/contactus</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>3.5</td>
  <td>LOW</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-11852</a></h3>
  <div class="csaf-accordion-content">
  <p>A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF Service. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-11852">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Apeman Cameras</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Apeman</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Apeman ID71: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Apeman did not respond to CISAs request for coordination. Users are encouraged to reach out to Apeman for support https://apemans.com/pages/contactus</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>CISA discovered the PoCs (Proof of Concept) as authored by Julio Urena</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24632
title: Lantronix EDS3000PS and EDS5000
release_date: Tue, 10 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.</strong></p>
  <p>The following versions of Lantronix EDS3000PS and EDS5000 are affected:</p>
  <ul>
  <li>EDS3000PS 3.1.0.0R2 (CVE-2025-67039, CVE-2025-70082, CVE-2025-67041)</li>
  <li>EDS5000 2.1.0.0R3 (CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.8</td>
  <td>Lantronix</td>
  <td>Lantronix EDS3000PS and EDS5000</td>
  <td>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Authentication Bypass Using an Alternate Path or Channel, Unverified Password Change</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Communications, Information Technology, Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67034</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67034">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS5000: 2.1.0.0R3</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038 Lantronix recommends users upgrade to EDS5000 version 2.2.0.0R1. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.2</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67035</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67035">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS5000: 2.1.0.0R3</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038 Lantronix recommends users upgrade to EDS5000 version 2.2.0.0R1. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.2</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67036</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67036">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS5000: 2.1.0.0R3</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038 Lantronix recommends users upgrade to EDS5000 version 2.2.0.0R1. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.2</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67037</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67037">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS5000: 2.1.0.0R3</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038 Lantronix recommends users upgrade to EDS5000 version 2.2.0.0R1. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.2</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67038</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67038">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS5000: 2.1.0.0R3</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038 Lantronix recommends users upgrade to EDS5000 version 2.2.0.0R1. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67039</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67039">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS3000PS: 3.1.0.0R2</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67039, CVE-2025-70082, and CVE-2025-67041, Lantronix recommends users upgrade to EDS3000PS version 3.2.0.0R2. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1349189633/Latest+Firmware+for+the+EDS3000PS+series.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/288.html">CWE-288 Authentication Bypass Using an Alternate Path or Channel</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-70082</a></h3>
  <div class="csaf-accordion-content">
  <p>The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-70082">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS3000PS: 3.1.0.0R2</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67039, CVE-2025-70082, and CVE-2025-67041, Lantronix recommends users upgrade to EDS3000PS version 3.2.0.0R2. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1349189633/Latest+Firmware+for+the+EDS3000PS+series.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/620.html">CWE-620 Unverified Password Change</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>2.7</td>
  <td>LOW</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-67041</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-67041">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Lantronix EDS3000PS and EDS5000</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Lantronix</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Lantronix EDS3000PS: 3.1.0.0R2</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>For vulnerabilities CVE-2025-67039, CVE-2025-70082, and CVE-2025-67041, Lantronix recommends users upgrade to EDS3000PS version 3.2.0.0R2. The patch can be found here: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1349189633/Latest+Firmware+for+the+EDS3000PS+series.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.2</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Francesco La Spina and Stanislav Dashevskyi of Forescout Technologies reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24626
title: CISA Adds Three Known Exploited Vulnerabilities to Catalog
release_date: Mon, 09 Mar 26 12:00:00 +0000
ingested_at: 2026-03-12 18:23:56
description:
  <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2021-22054" target="_blank">CVE-2021-22054</a> Omnissa Workspace ONE Server-Side Request Forgery</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-26399" target="_blank">CVE-2025-26399</a> SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-1603" target="_blank">CVE-2026-1603</a> Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability</li>
  </ul>
  <p>These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">KEV Catalog vulnerabilities</a> as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities" data-entity-type="node" data-entity-uuid="f2adba9a-0404-494c-a90c-4363a4a5c934" data-entity-substitution="canonical" title="Reducing the Significant Risk of Known Exploited Vulnerabilities">specified criteria</a>.</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/03/09/cisa-adds-three-known-exploited-vulnerabilities-catalog


iava_id: /node/24619
title: Delta Electronics CNCSoft-G2
release_date: Thu, 05 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-064-01
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-064-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could result in an attacker achieving remote code execution on the device.</strong></p>
  <p>The following versions of Delta Electronics CNCSoft-G2 are affected:</p>
  <ul>
  <li>CNCSoft-G2</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 7.8</td>
  <td>Delta Electronics</td>
  <td>Delta Electronics CNCSoft-G2</td>
  <td>Out-of-bounds Write</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Taiwan</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-3094</a></h3>
  <div class="csaf-accordion-content">
  <p>Delta Electronics CNCSoft-G2 devices prior to version V2.1.0.39 are vulnerable to an Out-of-Bounds Write while parsing DPAX files in the DOPSoft component.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-3094">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Delta Electronics CNCSoft-G2</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Delta Electronics</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Delta Electronics CNCSoft-G2: &lt;V2.1.0.39</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Delta Electronics recommends users update to Version 2.1.0.39, which has resolved this vulnerability. The update can be obtained from the Delta Electronics download center at https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&amp;q=cncsoft&amp;sort_expr=cdate&amp;sort_dir=DESC.</p>
  <p><strong>Mitigation</strong><br>For more information, see the associated Delta Electronics security advisory Delta-PCSA-2026-00004 which can be downloaded in PDF format here: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787 Out-of-bounds Write</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Natnael Samson (@NattiSamson) of TrendAI Zero Day Initiative reported this vulnerability to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>CISA recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-05</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-05</td>
  <td>1</td>
  <td>Initial Republication of Delta Electronics Delta-PCSA-2026-00004 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24625
title: CISA Adds Five Known Exploited Vulnerabilities to Catalog
release_date: Thu, 05 Mar 26 12:00:00 +0000
ingested_at: 2026-03-12 18:23:56
description:
  <p>CISA has added five new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2017-7921" target="_blank">CVE-2017-7921</a> Hikvision Multiple Products Improper Authentication Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2021-22681" target="_blank">CVE-2021-22681</a> Rockwell Multiple Products Insufficient Protected Credentials Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2021-30952" target="_blank">CVE-2021-30952</a> Apple Multiple Products Integer Overflow or Wraparound Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2023-41974" target="_blank">CVE-2023-41974</a> Apple iOS and iPadOS Use-After-Free Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2023-43000" target="_blank">CVE-2023-43000</a> Apple Multiple products Use-After-Free Vulnerability</li>
  </ul>
  <p>These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">KEV Catalog</a> vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities" data-entity-type="node" data-entity-uuid="f2adba9a-0404-494c-a90c-4363a4a5c934" data-entity-substitution="canonical" title="Reducing the Significant Risk of Known Exploited Vulnerabilities">specified criteria</a>.</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/03/05/cisa-adds-five-known-exploited-vulnerabilities-catalog


iava_id: https://www.cybercom.mil/Media/News/Article/4251832/uscybercom-hosts-cyber-flag-25-2/
title: USCYBERCOM Hosts Cyber Flag 25-2
release_date: Tue, 22 Jul 2025 16:03:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/4251832/uscybercom-hosts-cyber-flag-25-2/
ingested_at: 2026-03-12 19:15:44
description:
  SUFFOLK, Va. — U.S. Cyber Command launched Cyber Flag 25-2 at the Joint Warfighting Center in Suffolk, Virginia on July 7. As the largest, recurring, multi-national cyber exercise, Cyber Flag brings together over 20 partner nations for the month-long event, focused on enhancing defensive cyber operations.<br/>


title: USCYBERCOM Demonstrates Global Cyber Superiority with Cyber Guard 25-2
release_date: Thu, 05 Jun 2025 13:03:47 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4206702/uscybercom-demonstrates-global-cyber-superiority-with-cyber-guard-25-2/

description:
  FORT MEADE, Md. — U.S. Cyber Command launched its annual training exercise Cyber Guard 25-2 on June 2, reinforcing the nation's global preeminence in cyberspace operations. <br/> 
  <img src='https://media.defense.gov/2025/Jun/04/2003732685/150/150/0/250603-A-Q1826-1001.JPG' alt='Three uniformed military personnel working at a computer' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/4206702/uscybercom-demonstrates-global-cyber-superiority-with-cyber-guard-25-2/


title: Posture Statement of Lieutenant General William J. Hartman
release_date: Wed, 09 Apr 2025 19:30:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4150133/posture-statement-of-lieutenant-general-william-j-hartman/

description:
  POSTURE STATEMENT OF LIEUTENANT GENERAL WILLIAM J. HARTMAN, USA ACTING COMMANDER, UNITED STATES CYBER COMMAND BEFORE THE 119th CONGRESS SENATE COMMITTEE ON ARMED SERVICES SUBCOMMITTEE ON CYBERSECURITY 9 APRIL 2025<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/4150133/posture-statement-of-lieutenant-general-william-j-hartman/


title: U.S. Cyber Command Wraps Up Largest-Ever Cyber Guard Exercise
release_date: Thu, 20 Mar 2025 15:05:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4129291/us-cyber-command-wraps-up-largest-ever-cyber-guard-exercise/

description:
  U.S. Cyber Command concluded the first phase of its 11th annual command exercise, Cyber Guard, on March 18, 2025. The U.S. Cyber Command Cyber Guard exercise, in coordination with the Joint Staff, is part of a larger joint force exercise series designed to simulate real-world scenarios, to enable participants to practice internal and external staff processes for total force integration.

  <br/> 
  <img src='https://media.defense.gov/2025/Mar/20/2003673113/150/150/0/250317-A-Q1826-1001.JPG' alt='A uniformed military member sits at their computer while answering the phone.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/4129291/us-cyber-command-wraps-up-largest-ever-cyber-guard-exercise/


release_date: Fri, 14 Mar 2025 13:29:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4120206/reserve-cyber-and-signal-intelligence-summit-at-us-cyber-command-bridging-conne/

title:
  Reserve Cyber and Signal Intelligence Summit at U.S. Cyber Command: Bridging Connections, Building Futures

description:
  FORT GEORGE G. MEADE, Md. – U.S. Cyber Command hosted the 13th Reserve Cyber and Signal Intelligence Summit on February 20 and 21 in the Freidman Conference Center and brought together over 260 Reserve and National Guard members from 10 different states. <br/> 
  <img src='https://media.defense.gov/2025/Mar/14/2003667204/150/150/0/250220-A-Q1826-1002.JPG' alt='A uniformed Air Force officer stands on stage, speaking to a crowd.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/4120206/reserve-cyber-and-signal-intelligence-summit-at-us-cyber-command-bridging-conne/


title: Sweden Cyber Command and Air Forces Cyber align cyber compatibility
release_date: Fri, 07 Mar 2025 14:52:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4123381/sweden-cyber-command-and-air-forces-cyber-align-cyber-compatibility/

description:
  Together, 16th Air Force (Air Forces Cyber) and the Sweden Cyber Command are sharpening their competitive edge by teaming up to counter these malicious cyber activities.<br/> 
  <img src='https://media.defense.gov/2025/Mar/07/2003668790/150/150/0/250224-F-RN139-1002.JPG' alt='A group photo of Airmen and the Swedish Armed Forces.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/4123381/sweden-cyber-command-and-air-forces-cyber-align-cyber-compatibility/


title: U.S. Cyber Command Deputy Commander Highlights Collaboration, Innovation at UW-Madison Tech Talk
release_date: Fri, 22 Nov 2024 20:22:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3976294/us-cyber-command-deputy-commander-highlights-collaboration-innovation-at-uw-mad/

description:
  November 22, 2024 — Lt. Gen. William J. Hartman, Deputy Commander of U.S. Cyber Command, emphasized the importance of collaboration between academia, government, and industry during a keynote address at the University of Wisconsin-Madison on Thursday, Nov. 21, 2024.<br/> 
  <img src='https://media.defense.gov/2024/Nov/22/2003592856/150/150/0/241121-F-YW122-608.JPG' alt='A uniformed military officer looks at a device in a college student&#39;s hands.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3976294/us-cyber-command-deputy-commander-highlights-collaboration-innovation-at-uw-mad/


title: Media Release: USCYBERCOM Executes International Coordinated Cyber Security Activity 2024
release_date: Fri, 15 Nov 2024 19:34:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3966564/media-release-uscybercom-executes-international-coordinated-cyber-security-acti/

description:
  This month, U.S. Cyber Command launched the second iteration of the International Coordinated Cyber Security Activity (INCCA), a focused defensive cyberspace operation aimed at strengthening Department of Defense (DoD) networks and enhancing global cybersecurity partnerships.<br/> 
  <img src='https://media.defense.gov/2024/Nov/15/2003584625/150/150/0/241115-A-Q1826-1001.JPG' alt='Four service members coordinate during an INCCA.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3966564/media-release-uscybercom-executes-international-coordinated-cyber-security-acti/


title: USCYBERCOM Unveils AI Roadmap for Cyber Operations
release_date: Fri, 13 Sep 2024 06:00:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3905064/uscybercom-unveils-ai-roadmap-for-cyber-operations/

description:
  Mr. Michael Clark, deputy director of plans and policy at U.S. Cyber Command, presented a plan to integrate artificial intelligence into military cyber operations at AI Defense Forum, the annual defense and intelligence conference hosted by C3 AI, on Sept. 10, 2024. The AI roadmap aims to improve analytic capabilities, scale operations, and enhance adversary disruption.
  <br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3905064/uscybercom-unveils-ai-roadmap-for-cyber-operations/


title: U.S. Cyber Command Hosts First Offensive Cyber Flag 2024 Exercise
release_date: Tue, 03 Sep 2024 19:21:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3893166/us-cyber-command-hosts-first-offensive-cyber-flag-2024-exercise/

description:
  U.S. Cyber Command has concluded CYBER FLAG 24-2, marking a significant milestone as the first iteration of the exercise to incorporate Offensive Cyberspace Operations, August 30.<br/> 
  <img src='https://media.defense.gov/2024/Sep/04/2003537203/150/150/0/240829-A-Q1826-1002.JPG' alt='Soldier works behind keyboard.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3893166/us-cyber-command-hosts-first-offensive-cyber-flag-2024-exercise/


title: Russian Disinformation Campaign “DoppelGänger” Unmasked: A Web of Deception
release_date: Tue, 03 Sep 2024 12:21:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception/

description:
  The European Union’s Disinformation Lab (EU DisinfoLab) has recently exposed a sophisticated Russian influence campaign known as “DoppelGänger.” <br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception/


title: 7 CS infrastructure team completes base network upgrade
release_date: Tue, 02 Jul 2024 18:00:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3905062/7-cs-infrastructure-team-completes-base-network-upgrade/

description:
  DYESS AIR FORCE BASE, Texas – The 7th Communications Squadron infrastructure team completed a base-wide network improvement at Dyess Air Force Base,  May 24, 2024.

  During the planning phase, the infrastructure team worked with Air Force Global Strike Command for over three months to procure almost 400 network switches for Dyess. Additionally, the team had to survey the physical network capabilities of the base to ensure they could install the new system.<br/> 
  <img src='https://media.defense.gov/2024/Jul/02/2003543313/150/150/0/240626-F-BO786-1003.JPG' alt='U.S. Air Force Airmen with the 7th Communications Squadron infrastructure section pose for a team photo at Dyess Air Force Base, Texas, June 26, 2024. The team was recognized for their completion of a base-wide network improvement, spanning over nine months. The team overcame the challenge of the manpower and workload involved with maintaining normal base operations while simultaneously replacing and improving network hardware. (U.S. Air Force photo by Airman 1st Class Jade M. Caldwell)' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3905062/7-cs-infrastructure-team-completes-base-network-upgrade/


title: CNMF deploys first defensive cyber team to Zambia
release_date: Wed, 22 May 2024 13:01:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3783991/cnmf-deploys-first-defensive-cyber-team-to-zambia/

description:
  Cyber operators from U.S. Cyber Command’s Cyber National Mission Force recently returned from the command’s first-ever defensive cyber deployment to Zambia, bringing back strengthened collaborative ties with the partner and actionable insights to harden Zambian and U.S. networks. <br/> 
  <img src='https://media.defense.gov/2024/May/22/2003470598/150/150/0/240522-A-QI826-001.JPG' alt='US Zambia Graphic' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3783991/cnmf-deploys-first-defensive-cyber-team-to-zambia/


title: U.S. Cyber Command, DARPA Advance Partnership with New Agreement
release_date: Tue, 21 May 2024 13:17:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3782423/us-cyber-command-darpa-advance-partnership-with-new-agreement/

description:
  Following the creation of the Constellation pilot program launched in 2022 by U.S. Cyber Command and DARPA, the organizations recently signed a new binding agreement establishing the joint governance structure, roles, responsibilities, and budgeting goals to enable future planning.<br/> 
  <img src='https://media.defense.gov/2024/May/21/2003469824/150/150/0/240414-F-QI826-001.JPG' alt='Lieutenant General Hartman sits at a table with DARPA director Stefanie Tompkins while members of the program gather behind them for a group photo.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3782423/us-cyber-command-darpa-advance-partnership-with-new-agreement/


title: Morgan M. Adamski Appointed as Next Executive Director of USCYBERCOM
release_date: Fri, 03 May 2024 16:34:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/4051492/morgan-m-adamski-appointed-as-next-executive-director-of-uscybercom/

description:
  United States Cyber Command has announced the appointment of Ms. Morgan M. Adamski as its new Executive Director. Ms. Adamski will assume this critical position in early June 2024, bringing her extensive expertise and leadership to the forefront of the nation's cyber defense efforts.<br/> 
  <img src='https://media.defense.gov/2024/May/06/2003457339/150/150/0/240506-A-Q1826-1001.JPG' alt='Portrait picture of a woman' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/4051492/morgan-m-adamski-appointed-as-next-executive-director-of-uscybercom/


title: Cyber Recon 2024 Recognizes Excellence, Fosters Collaboration
release_date: Wed, 24 Apr 2024 18:12:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3754641/cyber-recon-2024-recognizes-excellence-fosters-collaboration/

description:
  ANNAPOLIS, Md. — U.S. Cyber Command hosted the second CyberRECon Symposium that showcased groundbreaking developments in cybersecurity and intelligence analysis with academic minds from around the country converging at the U.S. Naval Academy’s Alumni Hall to tackle some of the nation's toughest cyber challenges, April 17-18.<br/> 
  <img src='https://media.defense.gov/2024/Apr/24/2003449094/150/150/0/240418-A-Q1826-1001.JPG' alt='A group photo of individuals holding plaques.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3754641/cyber-recon-2024-recognizes-excellence-fosters-collaboration/


title: Posture Statement of General Timothy D. Haugh 2024
release_date: Fri, 12 Apr 2024 14:55:31 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3739700/posture-statement-of-general-timothy-d-haugh-2024/

description:
  POSTURE STATEMENT OF GENERAL TIMOTHY D. HAUGH COMMANDER, UNITED STATES CYBER COMMAND BEFORE THE 118TH CONGRESS SENATE COMMITTEE ON ARMED SERVICES 10 APRIL 2024<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3739700/posture-statement-of-general-timothy-d-haugh-2024/


title: USCYBERCOM: Fostering Innovation and Talent Development
release_date: Mon, 01 Apr 2024 18:38:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3726709/uscybercom-fostering-innovation-and-talent-development/

description:
  FORT GEORGE G. MEADE, Maryland  – The United States Cyber Command’s Academic Engagement Network program is aiming at enhancing the command’s ability to address critical mission challenges, foster innovation, and engage with students and faculty.<br/> 
  <img src='https://media.defense.gov/2024/Mar/12/2003411423/150/150/0/240312-D-PP983-001.PNG' alt='CYBER RECON 24 Seal' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3726709/uscybercom-fostering-innovation-and-talent-development/


title: Exercise CYBER GUARD 24: Sharpening Cybersecurity
release_date: Fri, 22 Mar 2024 16:40:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3716321/exercise-cyber-guard-24-sharpening-cybersecurity/

description:
  This month marked a significant stride in cybersecurity as U.S. Cyber Command’s Exercise Cyber Guard 2024 convened cyber professionals from across the command for this year’s first large scale exercise March 1-14. 
  This goal of Cyber Guard 2024 is to hone defensive capabilities and fortify collective cyber resilience. This year’s Cyber Guard integrated into the Large Scale Global Exercise (LSGE 24) for the first time, signifying a monumental collaboration.
  <br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3716321/exercise-cyber-guard-24-sharpening-cybersecurity/


title: JFHQ-DODIN to officially launch its new Cyber Operational Readiness Assessment Program March 1st
release_date: Wed, 28 Feb 2024 16:33:00 GMT
ingested_at: 2026-03-12 19:15:44
iava_id:
  https://www.cybercom.mil/Media/News/Article/3689870/jfhq-dodin-to-officially-launch-its-new-cyber-operational-readiness-assessment/

description:
  Following a successful nine-month pilot, Joint Force Headquarters–Department of Defense Information Network (JFHQ-DODIN) will officially launch its Cyber Operational Readiness Assessment program March 1.<br/> 
  <img src='https://media.defense.gov/2024/Feb/28/2003401776/150/150/0/240227-D-PY362-1001.JPG' alt='CORA Overview Graphic' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3689870/jfhq-dodin-to-officially-launch-its-new-cyber-operational-readiness-assessment/


iava_id: https://www.cybercom.mil/Media/News/Article/3647031/cnmf-marks-a-decade-defending-the-nation/
title: CNMF marks a decade Defending the Nation
release_date: Wed, 17 Jan 2024 14:22:41 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3647031/cnmf-marks-a-decade-defending-the-nation/
ingested_at: 2026-03-12 19:15:58
description:
  Ten years ago, on Jan. 17, 2014, the Cyber National Mission Force was activated as a subordinate unit to U.S. Cyber Command with a mission to plan, direct and synchronize cyberspace operations to deter, deny, and if necessary, defeat adversary cyber actors in order to Defend the Nation.<br/> 
  <img src='https://media.defense.gov/2024/Jan/17/2003377273/150/150/0/221219-D-D0451-0010.JPG' alt='The Cyber National Mission Force seal' /> <br />


iava_id: https://www.cybercom.mil/Media/News/Article/3647026/integrating-space-into-information-warfare/
title: Integrating space into Information Warfare
release_date: Tue, 16 Jan 2024 18:30:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3647026/integrating-space-into-information-warfare/
ingested_at: 2026-03-12 19:15:58
description:
  As the U.S. Air Force’s competition force, 16th Air Force (Air Forces CYBER) cultivates air and space superiority by integrating space into all warfighting functions to enhance integrated deterrence.

  This integration unifies 16th Air Force’s mission support with Space Operations Command to grow readiness. <br/> 
  <img src='https://media.defense.gov/2024/Jan/16/2003377268/150/150/0/231115-F-CT549-1039.JPG' alt='A photo of service members walking towards a building.' /> <br />


title: US, Allies Highlight Russian-State Cyber Actor “Star Blizzard” Spear-phishing Campaigns
release_date: Thu, 07 Dec 2023 18:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3610373/us-allies-highlight-russian-state-cyber-actor-star-blizzard-spear-phishing-camp/

description:
  U.S. Cyber Command’s Cyber National Mission Force, alongside interagency and foreign partners, issued a joint Cybersecurity Advisory highlighting advanced spear-phishing campaigns from Russia-based malicious cyber actors<br/> 
  <img src='https://media.defense.gov/2023/Dec/07/2003353529/150/150/0/231207-D-SC900-8146.JPG' alt='An illustration accompanying a joint Cybersecurity Advisory' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3610373/us-allies-highlight-russian-state-cyber-actor-star-blizzard-spear-phishing-camp/


title: 16th Air Force cyber warriors increase interoperability during Cyber Coalition 2023
release_date: Wed, 06 Dec 2023 17:59:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3633256/16th-air-force-cyber-warriors-increase-interoperability-during-cyber-coalition/

description:
  Sixteenth Air Force (Air Forces Cyber) served as the Air component command and U.S. representative for NATO’s annual Cyber Coalition exercise, Nov. 27–Dec. 1<br/> 
  <img src='https://media.defense.gov/2023/Dec/06/2003369574/150/150/0/231130-F-YI823-1001.JPG' alt='Capt. Ryan Baity, (left) 33d Cyberspace Operations Squadron exercise lead, discusses cyber defense with 1st Lt. Tricia Dang, 834th COS mission element lead and Justin Connelley, 834th COS host analyst, during Cyber Coalition 2023, Joint Base San Antonio, Lackland, Nov. 30, 2023.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3633256/16th-air-force-cyber-warriors-increase-interoperability-during-cyber-coalition/


iava_id: https://www.cybercom.mil/Media/News/Article/3610711/about-the-cyber-national-mission-forces/
title: About the Cyber National Mission Forces
release_date: Wed, 06 Dec 2023 05:00:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3610711/about-the-cyber-national-mission-forces/
ingested_at: 2026-03-12 19:15:58
description:
  U.S. Cyber Command’s Cyber National Mission Force has rapidly evolved to meet the needs of the Nation and has participated in or responded to almost every national crisis the U.S. has faced.<br/>


title: CYBERCOM and the National Defense University hosts Third Annual Cyber Symposium
release_date: Wed, 06 Dec 2023 05:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3641541/cybercom-and-the-national-defense-university-hosts-third-annual-cyber-symposium/

description:
  Cyber leaders from across multiple sectors descended upon the National Defense University’s (NDU) campus to participate in the third annual Cyber Symposium hosted by U.S. Cyber Command on Dec. 5 of 2023. 

  Co-sponsored with the NDU’s College of Information and Cyberspace (CIC), this iteration of the Cyber Symposium served as an opportunity to welcome a diverse group of cyber experts from government, the military, academia, and industry to engage in a rich conversation about the future of cyberspace and information with a strong focus on Artificial Intelligence (AI).
  <br/> 
  <img src='https://media.defense.gov/2024/Jan/10/2003374062/150/150/0/231205-A-QI826-1001.JPG' alt='U.S. Army Gen. Paul M. Nakasone, commander of U.S. Cyber Command, gives his opening remarks a keynote speaker for the Cyber Symposium at the National Defense University in Washington D.C., December 5, 2023.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3641541/cybercom-and-the-national-defense-university-hosts-third-annual-cyber-symposium/


title: Media Release: CYBERCOM executes international coordinated defensive cyber Activity
release_date: Mon, 23 Oct 2023 13:14:48 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3565194/media-release-cybercom-executes-international-coordinated-defensive-cyber-activ/

description:
  U.S. Cyber Command will conduct a focused internal defensive cyberspace activity during the month of October.  
  CYBERCOM has identified this event as the International Coordinated Cyber Security Activity, INCCA. This activity will highlight and enhance CYBERCOM's readiness, interoperability, global cyber security posture, cooperation, and support for the Joint Force Commanders, interagency partners, and international partners. 
  <br/> 
  <img src='https://media.defense.gov/2023/Oct/23/2003325475/150/150/0/230920-A-QI826-1001.JPG' alt='Joint Operation Center watch floor personnel at U.S. Cyber Command recap daily defensive cyber actions supporting an International Coordinated Cyber Security Activity.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3565194/media-release-cybercom-executes-international-coordinated-defensive-cyber-activ/


iava_id: https://www.cybercom.mil/Media/News/Article/3565190/joint-cyber-operations-strengthen-dod-networks/
title: Joint Cyber Operations Strengthen DoD Networks
release_date: Thu, 19 Oct 2023 17:34:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3565190/joint-cyber-operations-strengthen-dod-networks/
ingested_at: 2026-03-12 19:15:58
description:
  Cyber Protection Teams from Fleet Cyber Command, 16th Air Force (Air Forces Cyber) and Army Threat Systems Management Office strengthened computer networks during a joint Hunt Operation on Department of Defense systems in Hawaii, Aug. 4-12, 2023.<br/> 
  <img src='https://media.defense.gov/2023/Oct/19/2003325443/150/150/0/190402-N-KB349-1001.JPG' alt='A graphic of .S. Navy Fleet Cyber Command&#39;s logos.' /> <br />


title: Don’t be a target: How to identify adversarial propaganda
release_date: Thu, 05 Oct 2023 15:43:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3551070/dont-be-a-target-how-to-identify-adversarial-propaganda/

description:
  Strategic competitors, adversaries and proxies use information to gain an advantage over the U.S. joint force. <br/> 
  <img src='https://media.defense.gov/2023/Oct/05/2003315563/150/150/0/231005-F-CT549-1001.PNG' alt='A graphic on how a false narrative is created and spread.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3551070/dont-be-a-target-how-to-identify-adversarial-propaganda/


iava_id: https://www.cybercom.mil/Media/News/Article/3551068/information-operations-creates-global-reach/
title: Information Operations creates global reach
release_date: Tue, 03 Oct 2023 19:34:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3551068/information-operations-creates-global-reach/
ingested_at: 2026-03-12 19:15:58
description:
  Integrated deterrence starts at the lowest level and at 16th Air Force’s (AFCYBER) 67th Cyberspace Wing A39, the Information Operations team is making a global impact at their level. <br/> 
  <img src='https://media.defense.gov/2023/Oct/03/2003315561/150/150/0/210101-F-IY571-1006.JPG' alt='A photo of people working together at the Emerald Warrior exercise.' /> <br />


title: “Building Resilience”: U.S. returns from second defensive Hunt Operation in Lithuania
release_date: Tue, 12 Sep 2023 13:16:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3522801/building-resilience-us-returns-from-second-defensive-hunt-operation-in-lithuania/

description:
  U.S. Cyber Command’s Cyber National Mission Force recently concluded their second defensive hunt operation to Lithuania, building upon relationships and experiences from their previous deployment to the country in May 2022.

  U.S. cyber operators spent months alongside their counterparts from Lithuania’s Information Technology and Communications Department, part of the country’s Ministry of the Interior. The teams analyzed key networks, identified and prioritized by the partner, for evidence of malicious cyber activity while identifying vulnerabilities.<br/> 
  <img src='https://media.defense.gov/2023/Sep/12/2003298675/150/150/0/230912-D-D0451-0001.JPG' alt='US Lithuania Graphic' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3522801/building-resilience-us-returns-from-second-defensive-hunt-operation-in-lithuania/


title: CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts
release_date: Thu, 07 Sep 2023 16:37:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3518476/cnmf-and-partners-illuminate-multiple-nation-state-exploitation-efforts/

description:
  FORT GEORGE G. MEADE, Md. – U.S. Cyber Command’s Cyber National Mission Force, alongside Department<br/> 
  <img src='https://media.defense.gov/2023/Sep/07/2003295935/150/150/0/230907-D-D0451-0001.PNG' alt='Joint Cybersecurity Advisory CVEs' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3518476/cnmf-and-partners-illuminate-multiple-nation-state-exploitation-efforts/


title: CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts
release_date: Thu, 07 Sep 2023 16:37:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3523324/cnmf-and-partners-illuminate-multiple-nation-state-exploitation-efforts/

description:
  U.S. Cyber Command’s Cyber National Mission Force, alongside Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation released a public joint seal cybersecurity advisory, “Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475,” on Sept. 7.

  The CSA provides information on an incident at an Aeronautical Sector organization. Nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access through the organization’s public-facing application, establish persistence and move laterally within the network. Advance persistent threat actors often scan internet-facing devices for vulnerabilities that can be easily be exploited and will continue to do so.<br/> 
  <img src='https://media.defense.gov/2023/Sep/07/2003295935/150/150/0/230907-D-D0451-0001.PNG' alt='Joint Cybersecurity Advisory CVEs' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3523324/cnmf-and-partners-illuminate-multiple-nation-state-exploitation-efforts/


release_date: Thu, 29 Jun 2023 18:13:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3444464/cybercoms-under-advisement-to-increase-private-sector-partnerships-industry-dat/

title:
  CYBERCOM’s “Under Advisement” to increase private sector partnerships, industry data-sharing in 2023

description:
  USCYBERCOM’s “Under Advisement” to increase private sector partnerships, industry data-sharing in 2023<br/> 
  <img src='https://media.defense.gov/2023/Jun/29/2003251190/150/150/0/230629-D-D0451-0002.JPG' alt='UNAD Logo 2' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3444464/cybercoms-under-advisement-to-increase-private-sector-partnerships-industry-dat/


title: Commander, U.S. Cyber Command rolls out new Strategic Priorities
release_date: Thu, 18 May 2023 20:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3399867/commander-us-cyber-command-rolls-out-new-strategic-priorities/

description:
  Commander, U.S. Cyber Command rolls out new Strategic Priorities<br/> 
  <img src='https://media.defense.gov/2023/May/18/2003225392/150/150/0/230518-D-D0451-0001.JPG' alt='Commander&#39;s priorities' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3399867/commander-us-cyber-command-rolls-out-new-strategic-priorities/


title: “Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Operations
release_date: Wed, 10 May 2023 12:39:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3390470/shared-threats-shared-understanding-us-canada-and-latvia-conclude-defensive-hun/

description:
  “Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Operations<br/> 
  <img src='https://media.defense.gov/2023/May/10/2003219479/150/150/0/230510-D-D0451-0001.JPG' alt='Hunt Forward Latvia' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3390470/shared-threats-shared-understanding-us-canada-and-latvia-conclude-defensive-hun/


title: U.S. and Allies Identify and Expose Russian Intelligence-Gathering “Snake” Malware
release_date: Tue, 09 May 2023 15:24:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3389285/us-and-allies-identify-and-expose-russian-intelligence-gathering-snake-malware/

description:
  U.S. and Allies Identify and Expose Russian Intelligence-Gathering “Snake” Malware<br/> 
  <img src='https://media.defense.gov/2023/May/09/2003218742/150/150/0/230509-D-D0451-0001.PNG' alt='Snake Malware' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3389285/us-and-allies-identify-and-expose-russian-intelligence-gathering-snake-malware/


release_date: Thu, 23 Mar 2023 12:35:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3337717/committed-partners-in-cyberspace-following-cyberattack-us-conducts-first-defens/

title:
  “Committed Partners in Cyberspace”: Following cyberattack, US conducts first defensive Hunt Operation in Albania

description:
  “Committed Partners in Cyberspace”: US concludes first defensive Hunt Operation in Albania<br/> 
  <img src='https://media.defense.gov/2023/Mar/22/2003184543/150/150/0/230322-D-D0451-0001.JPG' alt='Hunt Forward Albania' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3337717/committed-partners-in-cyberspace-following-cyberattack-us-conducts-first-defens/


title: 2023 POSTURE STATEMENT OF GENERAL PAUL M. NAKASONE
release_date: Tue, 07 Mar 2023 05:00:00 GMT
description: POSTURE STATEMENT OF GENERAL PAUL M. NAKASONE<br/>
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3320195/2023-posture-statement-of-general-paul-m-nakasone/

source_url:
  https://www.cybercom.mil/Media/News/Article/3320195/2023-posture-statement-of-general-paul-m-nakasone/


iava_id: https://www.cybercom.mil/Media/News/Article/3256645/us-cyber-command-2022-year-in-review/
title: U.S. Cyber Command 2022 Year in Review
release_date: Fri, 30 Dec 2022 15:45:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3256645/us-cyber-command-2022-year-in-review/
ingested_at: 2026-03-12 19:15:58
description:
  U.S. Cyber Command 2022 Year in Review<br/> 
  <img src='https://media.defense.gov/2022/Oct/07/2003092987/150/150/0/221007-D-D0451-1005.JPG' alt='CODE Wallpaper Widescreen 2' /> <br />


iava_id: https://www.cybercom.mil/Media/News/Article/3229404/us-cyber-command-darpa-initiate-pilot-program/
title: U.S. Cyber Command, DARPA Initiate Pilot Program
release_date: Mon, 28 Nov 2022 19:11:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3229404/us-cyber-command-darpa-initiate-pilot-program/
ingested_at: 2026-03-12 19:15:58
description:
  The United States Cyber Command (CYBERCOM) and DARPA are kicking off a pilot program aimed at<br/> 
  <img src='https://media.defense.gov/2022/Nov/28/2003121686/150/150/0/221125-D-D0451-0201.PNG' alt='Darpa logo' /> <br />


iava_id: https://www.cybercom.mil/Media/News/Article/3206393/cyber-101-cyber-mission-force/
title: CYBER 101 – Cyber Mission Force
release_date: Tue, 01 Nov 2022 17:04:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3206393/cyber-101-cyber-mission-force/
ingested_at: 2026-03-12 19:15:58
description:
  The Cyber Mission Force (CMF) is U.S. Cyber Command’s (USCYBERCOM) action arm. CMF teams execute the command’s mission to direct, synchronize and coordinate cyberspace operations in defense of U.S. national interests. Members of the CMF work to ensure commanders across the Joint Force can operate freely in the cyber domain and accomplish their assigned missions.<br/>


title: CYBER 101 - Defend Forward and Persistent Engagement
release_date: Tue, 25 Oct 2022 16:28:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3198878/cyber-101-defend-forward-and-persistent-engagement/

description:
  Cyberspace is not governed by a central body, but by numerous government and non-governmental organizations across the globe. The cyber domain is not naturally occurring and is wholly dependent upon owned or leased technology on both government and commercial infrastructure providers for its existence and operation. Due to the ever-evolving technological aspects of the information environment, adversaries are continuously looking to disrupt and degrade the integrity of U.S. information networks and those of its allies and partners.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3198878/cyber-101-defend-forward-and-persistent-engagement/


iava_id: https://www.cybercom.mil/Media/News/Article/3192016/cyber-101-us-cyber-command-mission/
title: CYBER 101 - U.S. Cyber Command Mission
release_date: Tue, 18 Oct 2022 17:45:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3192016/cyber-101-us-cyber-command-mission/
ingested_at: 2026-03-12 19:15:58
description:
  The mission of U.S. Cyber Command (USCYBERCOM) is to plan and execute global cyber operations, activities, and missions to defend and advance national interests in collaboration with domestic and international partners across the full spectrum of competition and conflict.<br/>


title: CYBERCOM executed global cyberspace defensive operation
release_date: Mon, 17 Oct 2022 18:52:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3190716/cybercom-executed-global-cyberspace-defensive-operation/

description:
  U.S. Cyber Command conducted a new defensive cyberspace operation concept from October 3-14, 2022.<br/> 
  <img src='https://media.defense.gov/2022/Oct/18/2003097703/150/150/0/221003-N-XK809-1002.JPG' alt='221003-N-XK809-1002 FORT GEORGE G. MEADE, Md. (Oct. 3, 2022) Cryptologic Technician (Networks) 2nd Class Samantha Thompson, assigned to U.S. Fleet Cyber Command / U.S. 10th Fleet, mans the defensive cyber operations watch officer desk in the maritime operations center in support of Global Cyber Defensive Operations. The Global Cyber Defensive Operations is a U.S. Cyber Command led enduring defensive campaigning activity with partners to hunt and identify Indicators of Compromise commonly used by malicious cyberspace actors on designated networks supporting the Joint Force’s logistics and power projection capabilities globally. (U.S. Navy photo by Mass Communication Specialist 1st Class William Sykes)' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3190716/cybercom-executed-global-cyberspace-defensive-operation/


iava_id: https://www.cybercom.mil/Media/News/Article/3114872/gen-nakasone-visits-jtf-sd/
title: GEN Nakasone visits JTF-SD
release_date: Thu, 28 Jul 2022 17:23:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3114872/gen-nakasone-visits-jtf-sd/
ingested_at: 2026-03-12 19:15:58
description:
  U.S. Army Gen. Paul M. Nakasone, commander of U.S. Cyber Command, director of the National Security Agency and chief of the Central Security Service, speaks with U.S. Space Force Brig. Gen. Dennis Bythewood, deputy commander of the Joint Task Force-Space Defense at Schriever Space Force Base, Colorado, July 26, 2022. Nakasone visited the organization to better understand how intelligence supports the JTF-SD mission. The JTF-SD, and its National Space Defense Center, provide unprecedented unity of effort with the Department of Defense, Intelligence Community and National Reconnaissance Office to protect and defend against threats in the space domain. Through this partnering, the JTF-SD brings to bear the full force of the U.S. Government and synchronizes space superiority planning and operations. (U.S. Space Force photo by Lekendrick Stallworth)<br/> 
  <img src='https://media.defense.gov/2022/Jul/28/2003048665/150/150/0/220726-F-NO007-0003.JPG' alt='Two military men walking in uniform' /> <br />


title: Cyber National Mission Force discloses IOCs from Ukrainian networks
release_date: Wed, 20 Jul 2022 14:30:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/

description:
  FORT GEORGE E. MEADE, Md.-- In close coordination with the Security Service of Ukraine, USCYBERCOM’s<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/


title: U.S. Cyber Command Recruiters at Fort George G. Meade Community Job Fair
release_date: Fri, 06 May 2022 16:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3022820/us-cyber-command-recruiters-at-fort-george-g-meade-community-job-fair/

description:
  After two years of virtual engagements, U.S. Cyber Command recruiters are excited to meet candidates<br/> 
  <img src='https://media.defense.gov/2022/May/06/2002991772/150/150/0/220506-X-XX001-0001.JPG' alt='Fort George G. Meade Community Job Fair, Wednesday, 11 May. The job fair will be held at Club Meade from 10 a.m. until 2 p.m.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3022820/us-cyber-command-recruiters-at-fort-george-g-meade-community-job-fair/


title: U.S. conducts first Hunt Forward Operation in Lithuania
release_date: Wed, 04 May 2022 16:46:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3505610/us-conducts-first-hunt-forward-operation-in-lithuania/

description:
  At the invitation of the Lithuanian government, U.S. Cyber Command’s Cyber National Mission Force deployed a hunt forward team to conduct defensive cyber operations alongside partner cyber forces, concluding in May. For three months, the U.S. cyber operators hunted for malicious cyber activity on key Lithuanian national defense systems and Ministry of Foreign Affairs’ networks alongside its allies. This was the first shared defensive cyber operation between Lithuanian cyber forces and CNMF in their country. 
  <br/> 
  <img src='https://media.defense.gov/2023/Aug/25/2003288387/150/150/0/230825-D-D0451-0001.JPG' alt='Lithuanian graphic' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3505610/us-conducts-first-hunt-forward-operation-in-lithuania/


title: Guard, Reserve Component Summit exemplifies ‘Cyber Is a Team Sport’
release_date: Fri, 22 Apr 2022 18:57:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/3008313/guard-reserve-component-summit-exemplifies-cyber-is-a-team-sport/

description:
  Senior leaders from around the U.S. Cyber Command enterprise attended a summit on April 19 at the<br/> 
  <img src='https://media.defense.gov/2022/Apr/22/2002982486/150/150/0/220419-N-KT462-001.JPG' alt='Senior leaders from around the U.S. Cyber Command enterprise attended a summit on April 19, 2022, at the command’s headquarters on Fort George G. Meade to discuss the future of cyber operations, evolving capabilities, and deeper integration. (DoD Photo by Chief Mass Communication Specialist John Dasbach)' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/3008313/guard-reserve-component-summit-exemplifies-cyber-is-a-team-sport/


title: Posture statement of Gen. Paul M. Nakasone, commander, U.S. Cyber Command before the 117th Congress
release_date: Tue, 05 Apr 2022 13:54:07 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2989087/posture-statement-of-gen-paul-m-nakasone-commander-us-cyber-command-before-the/

description:
  Gen. Paul M. Nakasone, commander, U.S. Cyber Command, on Tuesday, April 5, 2022 will testify in front of the Senate Committee on Armed Services and the House Committee on Armed Services, Cyber, Innovative Technologies, and Information Systems Subcommittees.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/2989087/posture-statement-of-gen-paul-m-nakasone-commander-us-cyber-command-before-the/


iava_id: https://www.cybercom.mil/Media/News/Article/3007481/cyber-command-seeking-world-class-talent/
title: Cyber Command Seeking World-Class Talent
release_date: Fri, 01 Apr 2022 04:00:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/3007481/cyber-command-seeking-world-class-talent/
ingested_at: 2026-03-12 19:15:58
description:
  The threats against the nation's infrastructure and cyber networks are asymmetrical, persistent, and<br/>


release_date: Thu, 24 Feb 2022 21:38:00 GMT
description: Summary Actions to Take Today to Protect Against Malicious<br/>
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2945592/iranian-government-sponsored-actors-conduct-cyber-operations-against-global-gov/

title:
  Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

source_url:
  https://www.cybercom.mil/Media/News/Article/2945592/iranian-government-sponsored-actors-conduct-cyber-operations-against-global-gov/


title: Iranian intel cyber suite of malware uses open source tools
release_date: Wed, 12 Jan 2022 18:31:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/

description:
  To better enable defense against malicious cyber actors, U.S. Cyber Command’s Cyber National Mission Force has identified and disclosed multiple open-source tools that Iranian intelligence actors are using in networks around the world.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/


title: Partners in Cyberspace: US and United Kingdom Reaffirm Commitment
release_date: Thu, 18 Nov 2021 15:02:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2847471/partners-in-cyberspace-us-and-united-kingdom-reaffirm-commitment/

description:
  For the first time in two years, the United Kingdom and United States militaries conducted an in-person headquarters-level forum to discuss combined cyberspace campaigns and capabilities, called the Cyber Management Review, Nov. 9, 2021.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/2847471/partners-in-cyberspace-us-and-united-kingdom-reaffirm-commitment/


title: Cyber Command hosts 2021 Reserve Components Summit
release_date: Tue, 31 Aug 2021 15:51:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2759802/cyber-command-hosts-2021-reserve-components-summit/

description:
  U.S. Cyber Command hosted its 10th annual Reserve Components (RC) Summit 20-21 August. The theme for the 2021 RC Summit was “Maximizing the Total Force Advantage,” which focuses on advancing the Total Force’s cyber warfighting capability.<br/> 
  <img src='https://media.defense.gov/2021/Aug/26/2002840320/150/150/0/210820-D-LA132-0407.JPG' alt='U.S. Army General Paul M. Nakasone, U.S. Cyber Command  commander and National Security Agency director, presents opening remarks for the 10th annual Reserve Component Summit at Fort George G. Meade, Md., Aug. 20, 2021.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2759802/cyber-command-hosts-2021-reserve-components-summit/


title: Japanese State Minister of Defense Nakayama visits U.S. Cyber Command
release_date: Wed, 11 Aug 2021 17:34:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2727713/japanese-state-minister-of-defense-nakayama-visits-us-cyber-command/

description:
  Yasuhide Nakayama, State Minister of Defense for Japan, visited U.S. Cyber Command at Ft. Meade on August 9, 2021 to meet with senior leaders.<br/> 
  <img src='https://media.defense.gov/2021/Aug/11/2002828923/150/150/0/210809-D-LA132-0036.JPG' alt='U.S. Army Gen. Paul M. Nakasone, U.S. Cyber Command commander and National Security Agency director, greets the Honorable Yasuhide Nakayama, Japan Ministry of Defense, State Minister of Defense, at Fort George G. Meade, Md., Aug. 9, 2021.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2727713/japanese-state-minister-of-defense-nakayama-visits-us-cyber-command/


title: US, France partner for bilateral training exercise, Cyber Fort III
release_date: Fri, 30 Jul 2021 19:25:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2714684/us-france-partner-for-bilateral-training-exercise-cyber-fort-iii/

description:
  Cyber Fort III, recently held on Fort George G. Meade, Md., was a bilateral, hands-on-keyboard exercise between U.S Cyber Command and France's Cyber Defense Forces Command designed to combat challenges posed by advanced persistent threats and ensure common defense in cyberspace.<br/> 
  <img src='https://media.defense.gov/2021/Jul/29/2002815488/150/150/0/210721-D-LA132-0111.JPG' alt='U.S. Cyber Command and French cyber warriors collaborate during the training exercise, Cyber Fort III, at Fort George G. Meade, Md., July 21, 2021.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2714684/us-france-partner-for-bilateral-training-exercise-cyber-fort-iii/


title: A Command First: CNMF trains, certifies task force in full-spectrum operations
release_date: Mon, 07 Jun 2021 13:01:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2647621/a-command-first-cnmf-trains-certifies-task-force-in-full-spectrum-operations/

description:
  For the first time in U.S. Cyber Command history, a Cyber National Mission Force task force exercised, tested, and certified the capability to execute full-spectrum operations, including defensive, offensive, and information operations.
  <br/> 
  <img src='https://media.defense.gov/2021/Jun/07/2002736051/150/150/0/210524-D-LA132-0106.JPG' alt='U.S. Cyber Command, Cyber National Mission Force members participate in a training and readiness exercise at Fort George G. Meade, Md., May 24, 2021.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2647621/a-command-first-cnmf-trains-certifies-task-force-in-full-spectrum-operations/


title: US Cyber Command, DHS-CISA release Russian malware samples tied to SolarWinds compromise
release_date: Thu, 15 Apr 2021 16:37:38 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2574011/us-cyber-command-dhs-cisa-release-russian-malware-samples-tied-to-solarwinds-co/

description:
  U.S. Cyber Command and the Department of Homeland Security - Cybersecurity and Infrastructure Security Agency released eight files attributed to the Russian Foreign Intelligence Service (SVR)/APT 29 to enable public defense against further compromise.<br/> 
  <img src='https://media.defense.gov/2021/Apr/15/2002621550/150/150/0/210415-D-LA132-0001.JPG' alt='CNMF and CISA release Malware Analysis Report on multiple samples linked to SolarWinds supply chain attack by Russia.' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2574011/us-cyber-command-dhs-cisa-release-russian-malware-samples-tied-to-solarwinds-co/


iava_id: https://www.cybercom.mil/Media/News/Article/2526508/us-cyber-command-holds-2021-legal-conference/
title: US Cyber Command holds 2021 Legal Conference
release_date: Fri, 05 Mar 2021 17:48:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/2526508/us-cyber-command-holds-2021-legal-conference/
ingested_at: 2026-03-12 19:15:58
description:
  The 2021 U.S. Cyber Command Legal Conference was held virtually Thursday morning, and livestreamed on the Defense Visual Information Distribution Service. This annual conference explores current law and policy issues related to offensive and defensive cyberspace operations.
  <br/> 
  <img src='https://media.defense.gov/2021/Mar/05/2002594390/150/150/0/210304-N-KT462-7847.JPG' alt='Army Gen. Paul M. Nakasone, U.S. Cyber Command commander and National Security Agency director, remarks on the complexities associated with working within cyberspace during the 2021 USCYBERCOM Legal Conference, March 3, 2021.' /> <br />


title: US and Australia sign first-ever cyber agreement to develop virtual training range
release_date: Fri, 04 Dec 2020 13:22:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2434919/us-and-australia-sign-first-ever-cyber-agreement-to-develop-virtual-training-ra/

description:
  As part of the Dept. of Defense’s efforts to sharpen lethality, reform business practices, and<br/> 
  <img src='https://media.defense.gov/2020/Dec/04/2002546041/150/150/0/201103-F-LA132-0002.JPG' alt='Australian and United States Cyber Training Arrangement' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2434919/us-and-australia-sign-first-ever-cyber-agreement-to-develop-virtual-training-ra/


title: Hunt Forward Estonia: Estonia, US strengthen partnership in cyber domain with joint operation
release_date: Thu, 03 Dec 2020 13:29:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2433245/hunt-forward-estonia-estonia-us-strengthen-partnership-in-cyber-domain-with-joi/

description:
  Estonian and U.S. cyber commands jointly conducted a defensive cyber-operation on Estonian Defence<br/> 
  <img src='https://media.defense.gov/2020/Dec/03/2002545016/150/150/0/201203-F-LA132-0000.JPG' alt='Graphic' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/2433245/hunt-forward-estonia-estonia-us-strengthen-partnership-in-cyber-domain-with-joi/


iava_id: https://www.cybercom.mil/Media/News/Article/2342894/the-cutting-edge-of-defense/
title: The cutting edge of defense
release_date: Thu, 10 Sep 2020 17:18:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/2342894/the-cutting-edge-of-defense/
ingested_at: 2026-03-12 19:15:58
description:
  The cyberspace domain is one of the most critical areas of national defense. It is a field that<br/> 
  <img src='https://media.defense.gov/2021/May/24/2002725094/150/150/0/210524-D-LA132-0001.JPG' alt='USCYBERCOM' /> <br />


title: A Special Message from Maryland Governor Larry Hogan
release_date: Thu, 02 Apr 2020 18:22:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2134903/a-special-message-from-maryland-governor-larry-hogan/

description:
  Maryland Governor Larry Hogan addresses the U.S. Cyber Command and NSA workforce on the importance of their work during the COVID-19 global pandemic <br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/2134903/a-special-message-from-maryland-governor-larry-hogan/


title: US, Montenegro work together to defend against malicious cyber actors
release_date: Wed, 30 Oct 2019 13:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/2002939/us-montenegro-work-together-to-defend-against-malicious-cyber-actors/

description:
  For the second year in a row, at the invitation of the Montenegrin Government, an elite cyber team of U.S. service members is working alongside Montenegrin cyber defenders to counter malicious cyber actors on critical networks and platforms. Along with U.S. European Command, the U.S. Cyber Command team’s operations are part of U.S. efforts to persistently engage adversaries in cyberspace, working to protect critical infrastructure alongside valued partners and allies.  These defense operations also generate insights into adversarial cyber threats to the upcoming U.S. and Montenegrin elections in 2020.
  <br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/2002939/us-montenegro-work-together-to-defend-against-malicious-cyber-actors/


title: USCYBERCOM hiring events to fill Cyber Excepted Service positions
release_date: Wed, 21 Nov 2018 15:48:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1695454/uscybercom-hiring-events-to-fill-cyber-excepted-service-positions/

description:
  USCYBERCOM is hosting upcoming hiring events to fill Cyber Excepted Service positions, including two events Nov. 28 and Dec. 3.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/1695454/uscybercom-hiring-events-to-fill-cyber-excepted-service-positions/


title: New CNMF initiative shares malware samples with cybersecurity industry
release_date: Mon, 05 Nov 2018 17:29:14 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1681533/new-cnmf-initiative-shares-malware-samples-with-cybersecurity-industry/

description:
  Today, the Cyber National Mission Force posted its first malware sample to the website VirusTotal in an effort to share unclassified malware samples it believes will have an impact on improving global cybersecurity.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/1681533/new-cnmf-initiative-shares-malware-samples-with-cybersecurity-industry/


title: U.S. and Macedonia Participate in Cyber Defense Cooperation
release_date: Fri, 12 Oct 2018 13:02:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1660069/us-and-macedonia-participate-in-cyber-defense-cooperation/

description:
  U.S. service members, working alongside cyber defenders from the Republic of Macedonia, have been cooperating over the last few weeks to share best practices in cyber security and to build cyber defense capabilities.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/1660069/us-and-macedonia-participate-in-cyber-defense-cooperation/


title: U.S., Montenegro conduct groundbreaking cyber defense cooperation
release_date: Tue, 02 Oct 2018 16:33:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1651540/us-montenegro-conduct-groundbreaking-cyber-defense-cooperation/

description:
  U.S. service members worked alongside cyber defenders within the Government of Montenegro over the past few weeks to build cyber defense capabilities. U.S. Cyber Command Airmen, in cooperation with U.S. European Command, have worked closely with NATO ally Montenegro conducting Cyber Defense Security Cooperation to increase interoperability, build partner capacity, and deter malign influence on the democratic processes of our allies, partners and the U.S. <br/> 
  <img src='https://media.defense.gov/2018/Oct/02/2002047604/150/150/0/180928-A-JA380-018.JPG' alt='A member of the Ministry of Defense of Montenegro and a U.S. Cyber Command Airman, pose for a photo during Defensive Cooperation at Podgorica, Montenegro, Sept. 28, 2018. The U.S. and NATO Allies and partners are working together to provide agile forces to respond to 21st century security challenges – including cyber, hybrid and unconventional threats. Defensive Cyber cooperation is part of U.S. Cyber Command and U.S. European Command effort to support NATO allies and European partners by helping build their cyber defense capabilities. This collaboration builds cyber defense capabilities while enabling the teams to learn from one another and demonstrates that we will not tolerate foreign malign influence on the democratic processes of our allies and partners or in the U.S (U.S. Army photo by Spc. Craig Jensen)' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/1651540/us-montenegro-conduct-groundbreaking-cyber-defense-cooperation/


iava_id: https://www.cybercom.mil/Media/News/Article/1543870/uscybercom-is-hiring-more-to-come/
title: USCYBERCOM is hiring, more to come
release_date: Thu, 07 Jun 2018 17:26:16 GMT
source_url: https://www.cybercom.mil/Media/News/Article/1543870/uscybercom-is-hiring-more-to-come/
ingested_at: 2026-03-12 19:15:58
description:
  U.S. Cyber Command teamed up with the Air Force Personnel Center for the command’s first-ever public hiring event May 8 in Silver Spring, Maryland. The event, co-hosted by USCYBERCOM and AFPC’s Air Force Civilian Service talent acquisitions team, featured on-site resume reviews and interviews, with multiple qualified individuals receiving job offers on the spot.<br/>


title: Cyber Mission Force achieves Full Operational Capability
release_date: Thu, 17 May 2018 18:09:05 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1524492/cyber-mission-force-achieves-full-operational-capability/

description:
  All 133 of U.S. Cyber Command’s Cyber Mission Force teams achieved Full Operational Capability (FOC), USCYBERCOM officials announced today.<br/>

source_url:
  https://www.cybercom.mil/Media/News/Article/1524492/cyber-mission-force-achieves-full-operational-capability/


iava_id: https://www.cybercom.mil/Media/News/Article/1341294/us-cyber-command-flexes-new-acquisition-muscle/
title: U.S. Cyber Command flexes new acquisition muscle
release_date: Thu, 12 Oct 2017 21:00:00 GMT
source_url: https://www.cybercom.mil/Media/News/Article/1341294/us-cyber-command-flexes-new-acquisition-muscle/
ingested_at: 2026-03-12 19:15:58
description:
  U.S. Cyber Command has begun executing its new "limited acquisition authority" to speed up the acquisitions process for cyber-specific tools, officials here said.  <br/> 
  <img src='https://media.defense.gov/2016/Sep/30/2001733907/150/150/0/160930-F-00000-002.JPG' alt='USCYBERCOM Seal' /> <br />


title: Teams defend against simulated attacks in Cyber Guard exercise
release_date: Mon, 05 Jun 2017 04:00:00 GMT
ingested_at: 2026-03-12 19:15:58
iava_id:
  https://www.cybercom.mil/Media/News/Article/1340542/teams-defend-against-simulated-attacks-in-cyber-guard-exercise/

description:
  Cyber Guard 2017, a weeklong exercise conducted in June, tested and exercised the men and women of U.S. Cyber Command's Cyber Mission Force and interagency partner teams from across federal and state organizations tasked with defending critical infrastructure.
  <br/> 
  <img src='https://media.defense.gov/2017/Oct/12/2001826235/150/150/0/170705-N-JP302-707.JPG' alt='Active duty, reserve and National Guard service members participate in the Cyber Guard and Cyber Flag exercises sponsored by U.S. Cyber Command. The exercises focused on developing coordinated state government, National Guard, commercial enterprise, Defense Department and interagency responses to significant cyberspace-enabled attacks on U.S. domestic critical infrastructure by hostile actors' /> <br />

source_url:
  https://www.cybercom.mil/Media/News/Article/1340542/teams-defend-against-simulated-attacks-in-cyber-guard-exercise/


