# iava_bulletins

iava_id: /node/24613
title: Mobiliti e-mobi.hu
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-06.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of Mobiliti e-mobi.hu are affected:</p>
  <ul>
  <li>e-mobi.hu vers:all/*</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>Mobiliti</td>
  <td>Mobiliti e-mobi.hu</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Hungary</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-26051</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-26051">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobiliti e-mobi.hu</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobiliti</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobiliti e-mobi.hu: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://www.mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20882</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-20882">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobiliti e-mobi.hu</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobiliti</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobiliti e-mobi.hu: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://www.mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27764</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-27764">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobiliti e-mobi.hu</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobiliti</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobiliti e-mobi.hu: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://www.mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27777</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-27777">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobiliti e-mobi.hu</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobiliti</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobiliti e-mobi.hu: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://www.mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24610
title: Hitachi Energy RTU500 Product
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-03
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-03.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. Successful exploitation of these vulnerabilities can result in the exposure of low-value user management information and device outage. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.</strong></p>
  <p>The following versions of Hitachi Energy RTU500 Product are affected:</p>
  <ul>
  <li>RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/&gt;=12.7.1|&lt;=12.7.7, vers:RTU500_series_CMU_Firmware/&gt;=13.5.1|&lt;=13.5.4, vers:RTU500_series_CMU_Firmware/&gt;=13.6.1|&lt;=13.6.2, vers:RTU500_series_CMU_Firmware/&gt;=13.7.1|&lt;=13.7.7, 13.8.1&nbsp;</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 7.5</td>
  <td>Hitachi Energy</td>
  <td>Hitachi Energy RTU500 Product</td>
  <td>Improper Handling of Insufficient Permissions or Privileges , Incomplete List of Disallowed Inputs, Uncontrolled Recursion, Allocation of Resources Without Limits or Throttling</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Switzerland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1772</a></h3>
  <div class="csaf-accordion-content">
  <p>RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privileges.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1772">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy RTU500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RTU500 series CMU Firmware version 12.7.1 through 12.7.7, RTU500 series CMU Firmware version 13.5.1 through 13.5.4, RTU500 series CMU Firmware version 13.6.1 through 13.6.2, RTU500 series CMU Firmware version 13.7.1 through 13.7.7, RTU500 series CMU Firmware version 13.8.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 12.7.8</p>
  <p><strong>Mitigation</strong><br>Follow general mitigation factors/workarounds</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.7.8 or latest</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.8.2</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/280.html">CWE-280 Improper Handling of Insufficient Permissions or Privileges</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1773</a></h3>
  <div class="csaf-accordion-content">
  <p>IEC 60870-5-104: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 does not remediate the vulnerability but mitigates the risk of exploitation.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1773">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy RTU500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RTU500 series CMU Firmware version 12.7.1 through 12.7.7, RTU500 series CMU Firmware version 13.5.1 through 13.5.4, RTU500 series CMU Firmware version 13.6.1 through 13.6.2, RTU500 series CMU Firmware version 13.7.1 through 13.7.7, RTU500 series CMU Firmware version 13.8.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 12.7.8</p>
  <p><strong>Mitigation</strong><br>Follow general mitigation factors/workarounds</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.7.8 or latest</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.8.2</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/184.html">CWE-184 Incomplete List of Disallowed Inputs</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2024-8176</a></h3>
  <div class="csaf-accordion-content">
  <p>A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. Product is only affected if IEC61850 functionality is configured.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2024-8176">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy RTU500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RTU500 series CMU Firmware version 12.7.1 through 12.7.7, RTU500 series CMU Firmware version 13.5.1 through 13.5.4, RTU500 series CMU Firmware version 13.6.1 through 13.6.2, RTU500 series CMU Firmware version 13.7.1 through 13.7.7, RTU500 series CMU Firmware version 13.8.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 12.7.8</p>
  <p><strong>Mitigation</strong><br>Follow general mitigation factors/workarounds</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.7.8 or latest</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.8.2</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674 Uncontrolled Recursion</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-59375</a></h3>
  <div class="csaf-accordion-content">
  <p>libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. Product is only affected if IEC61850 functionality is configured.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2025-59375">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy RTU500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>RTU500 series CMU Firmware version 12.7.1 through 12.7.7, RTU500 series CMU Firmware version 13.5.1 through 13.5.4, RTU500 series CMU Firmware version 13.6.1 through 13.6.2, RTU500 series CMU Firmware version 13.7.1 through 13.7.7, RTU500 series CMU Firmware version 13.8.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 12.7.8</p>
  <p><strong>Mitigation</strong><br>Follow general mitigation factors/workarounds</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.7.8 or latest</p>
  <p><strong>Vendor fix</strong><br>Update to CMU Firmware version 13.8.2</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/770.html">CWE-770 Allocation of Resources Without Limits or Throttling</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Hitachi Energy PSIRT reported these vulnerabilities to CISA.</li>
  </ul>
  <hr>
  <h2>Notice</h2>
  <p>The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.</p>
  <hr>
  <h2>Support</h2>
  <p>For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.</p>
  <hr>
  <h2>General Mitigation Factors</h2>
  <p>Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000237 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-24</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-24</td>
  <td>1</td>
  <td>Initial public release</td>
  </tr>
  <tr>
  <td>2026-03-03</td>
  <td>2</td>
  <td>Initial CISA Republication of Hitachi Energy PSIRT 8DBD000237 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24612
title: Labkotec LID-3300IP
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-05
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-05.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could allow attackers to gain unauthorized control over system operations, leading to disruption of normal functionality and potential safety hazards.</strong></p>
  <p>The following versions of Labkotec LID-3300IP are affected:</p>
  <ul>
  <li>LID-3300IP vers:all/*</li>
  <li>LID-3300IP Type 2</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>Labkotec</td>
  <td>Labkotec LID-3300IP</td>
  <td>Missing Authentication for Critical Function</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Communications, Energy</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Finland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1775</a></h3>
  <div class="csaf-accordion-content">
  <p>The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attacker to alter device parameters and run operational commands when specially crafted packets are sent to the device.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1775">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Labkotec LID-3300IP</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Labkotec</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Labkotec LID-3300IP: vers:all/*, Labkotec LID-3300IP Type 2: &lt;V2.20</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Labkotec reports that it is not possible to implement secure and encrypted network traffic on the LID-3300IP. For this reason, Labkotec recommends updating ice detectors to the LID-3300IP Type 2 model and installing the latest firmware version V2.40. It is also highly recommended to activate HTTPS for network traffic. The device type and software version can be verified in the web interface.</p>
  <p><strong>Mitigation</strong><br>Devices not connected to an Ethernet network are not susceptible to this attack. Ice detectors operating on secure internal networks that adhere to modern security standards, where only authorized devices and users have access, are protected against external threats.</p>
  <p><strong>Mitigation</strong><br>Labkotec recommends implementing the following additional security controls:<br>Do not connect the device to the public Internet<br>Follow good security practices<br>Change Default Credentials<br>Enable Secure Management Access<br>Network Segmentation<br>Implement Firewall and Access Controls<br>Restrict Protocols<br>Monitor and Alert<br>Avoid Direct Internet Exposure<br>Keep Firmware Updated<br>Control Physical Access<br>Maintain Inventory and Access Reviews</p>
  <p><strong>Mitigation</strong><br>Users can find more information in Labkotec's security advisory (https://labkotec.fi/wp-content/uploads/CA-000001-Cybersecurity-Advisory.pdf).</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Souvik Kandar reported this vulnerability to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24614
title: ePower epower.ie
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-07
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-07.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of ePower epower.ie are affected:</p>
  <ul>
  <li>epower.ie vers:all/*&nbsp;</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>ePower</td>
  <td>ePower epower.ie</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Ireland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22552</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-22552">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>ePower epower.ie</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>ePower</div>
  <div class="ics-version"><strong>Product Version:</strong><br>ePower epower.ie: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>ePower did not respond to CISA's request for coordination. Contact ePower using their contact page here: https://www.epower.ie/support/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27778</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-27778">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>ePower epower.ie</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>ePower</div>
  <div class="ics-version"><strong>Product Version:</strong><br>ePower epower.ie: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>ePower did not respond to CISA's request for coordination. Contact ePower using their contact page here: https://www.epower.ie/support/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24912</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-24912">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>ePower epower.ie</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>ePower</div>
  <div class="ics-version"><strong>Product Version:</strong><br>ePower epower.ie: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>ePower did not respond to CISA's request for coordination. Contact ePower using their contact page here: https://www.epower.ie/support/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27770</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-27770">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>ePower epower.ie</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>ePower</div>
  <div class="ics-version"><strong>Product Version:</strong><br>ePower epower.ie: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>ePower did not respond to CISA's request for coordination. Contact ePower using their contact page here: https://www.epower.ie/support/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24611
title: Portwell Engineering Toolkits
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-04
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-04.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could allow a local attacker to escalate privileges or cause a denial-of-service condition.</strong></p>
  <p>The following versions of Portwell Engineering Toolkits are affected:</p>
  <ul>
  <li>Portwell Engineering Toolkits 4.8.2</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 8.8</td>
  <td>Portwell</td>
  <td>Portwell Engineering Toolkits</td>
  <td>Improper Restriction of Operations within the Bounds of a Memory Buffer</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Taiwan</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-3437</a></h3>
  <div class="csaf-accordion-content">
  <p>An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-3437">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Portwell Engineering Toolkits</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Portwell</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Portwell Portwell Engineering Toolkits: 4.8.2</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Portwell has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of Portwell Engineering Toolkits are invited to contact Portwell customer support (https://portwell.com/support.php) for additional information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/119.html">CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Jason Huang of Cyber Threat &amp; Product Defense Center of TXOne Networks Inc. reported this vulnerability to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24608
title: Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-62-01
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets to the affected products.</strong></p>
  <p>The following versions of Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module are affected:</p>
  <ul>
  <li>MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP &lt;=1.106, vers:all/* (CVE-2026-1874, CVE-2026-1876)</li>
  <li>MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP vers:all/* (CVE-2026-1874, CVE-2026-1875)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 7.5</td>
  <td>Mitsubishi Electric</td>
  <td>Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module</td>
  <td>Always-Incorrect Control Flow Implementation, Improper Resource Shutdown or Release</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Japan</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1874</a></h3>
  <div class="csaf-accordion-content">
  <p>An always-incorrect control flow implementation vulnerability may allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets to the affected products.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1874">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mitsubishi Electric</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP: &lt;=1.106, Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Users of FX5-ENET/IP versions 1.106 and prior should download the update file for version 1.107 or later and apply it. The update file is available at: https://www.mitsubishielectric.com/fa/download/index.html.</p>
  <p><strong>Mitigation</strong><br>The fixed version for the FX5-EIP is scheduled to be released in the near future. In the meantime, users should apply mitigations or workarounds.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to “13.1 IP Filter Function” in the MELSEC iQ-F FX5 User’s Manual (Communication).</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/670.html">CWE-670 Always-Incorrect Control Flow Implementation</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1875</a></h3>
  <div class="csaf-accordion-content">
  <p>An improper resource shutdown or release vulnerability in the affected products may allow a remote attacker to cause a denial-of-service condition by continuously sending UDP packets.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1875">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mitsubishi Electric</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>The fixed version for the FX5-EIP is scheduled to be released in the near future. In the meantime, users should apply mitigations or workarounds.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to “13.1 IP Filter Function” in the MELSEC iQ-F FX5 User’s Manual (Communication).</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/404.html">CWE-404 Improper Resource Shutdown or Release</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1876</a></h3>
  <div class="csaf-accordion-content">
  <p>An improper resource shutdown or release vulnerability may allow a remote attacker to cause a denial-of-service condition in the affected products by continuously sending UDP packets.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-1876">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mitsubishi Electric MELSEC iQ-F Series EtherNet/IP module and Ethernet module</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mitsubishi Electric</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>No fix planned</strong><br>Users should apply mitigations or workarounds since there are no plans to release a fixed version.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. and preventing unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version, Mitsubishi Electric recommends using the affected product within a LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version, Mitsubishi Electric recommends using the IP filter function of the affected product and blocking access from untrusted hosts, to minimize the risk of exploiting this vulnerability. For details on the IP filter function, refer to “13.1 IP Filter Function” in the MELSEC iQ-F FX5 User’s Manual (Communication).</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version, Mitsubishi Electric recommends restricting physical access to the affected product, as well as to PCs and network devices to which it is connected, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For users of products that do not have a fixed version, Mitsubishi Electric recommends installing anti-virus software on PCs that can access the affected product, to minimize the risk of exploiting this vulnerability.</p>
  <p><strong>Mitigation</strong><br>For more information, see Mitsubishi Electric 2025-021. https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/404.html">CWE-404 Improper Resource Shutdown or Release</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Mitsubishi Electric reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this notification (https://www.cisa.gov/notification) and this privacy &amp; use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a republication of Mitsubishi Electric security advisory "2025-021 Multiple denial-of-service vulnerabilities in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module" from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact CISA directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  <tr>
  <td>2026-03-03</td>
  <td>2</td>
  <td>Initial CISA Republication of Mitsubishi Electric security advisory 2025-021</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24609
title: Hitachi Energy Relion REB500 Product
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-02
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-02.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Hitachi Energy is aware of vulnerabilities that affect the Relion REB500 product versions listed in this document. Authenticated users with certain roles can exploit the vulnerabilities to access and modify the directory contents they are not authorized to do so. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.</strong></p>
  <p>The following versions of Hitachi Energy Relion REB500 Product are affected:</p>
  <ul>
  <li>Relion REB500 vers:Relion_REB500/&lt;=8.3.3.0 (CVE-2026-2459, CVE-2026-2460)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 6.8</td>
  <td>Hitachi Energy</td>
  <td>Hitachi Energy Relion REB500 Product</td>
  <td>Privilege Defined With Unsafe Actions</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Switzerland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-2459</a></h3>
  <div class="csaf-accordion-content">
  <p>A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-2459">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy Relion REB500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>REB500 versions 8.3.3.0 and prior</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Hitachi Energy recommends that users update to version 8.3.3.1.</p>
  <p><strong>Mitigation</strong><br>For CVE-2026-2459, as a mitigation strategy, users may also disable the Installer role and enable it only during the firmware update process.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/267.html">CWE-267 Privilege Defined With Unsafe Actions</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-2460</a></h3>
  <div class="csaf-accordion-content">
  <p>A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-2460">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Hitachi Energy Relion REB500 Product</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Hitachi Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>REB500 versions 8.3.3.0 and prior</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to version 8.3.3.1</p>
  <p><strong>Mitigation</strong><br>Apply general mitigation factors</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/267.html">CWE-267 Privilege Defined With Unsafe Actions</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.8</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Hitachi Energy reported this vulnerability to CISA.</li>
  </ul>
  <hr>
  <h2>Notice</h2>
  <p>The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.</p>
  <hr>
  <h2>Support</h2>
  <p>For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.</p>
  <hr>
  <h2>General Mitigation Factors</h2>
  <p>Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000217 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-24</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-24</td>
  <td>1</td>
  <td>Initial public release</td>
  </tr>
  <tr>
  <td>2026-03-03</td>
  <td>2</td>
  <td>Initial CISA Republication of Hitachi Energy PSIRT 8DBD000217 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24615
title: Everon OCPP Backends
release_date: Tue, 03 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-08
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-08.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of Everon OCPP Backends are affected:</p>
  <ul>
  <li>api.everon.io vers:all/*&nbsp;</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>Everon</td>
  <td>Everon OCPP Backends</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Netherlands</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-26288</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-26288">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Everon OCPP Backends</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Everon</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Everon api.everon.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Everon has shut down their platform on December 1st, 2025.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24696</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-24696">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Everon OCPP Backends</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Everon</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Everon api.everon.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Everon has shut down their platform on December 1st, 2025.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20748</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-20748">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Everon OCPP Backends</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Everon</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Everon api.everon.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Everon has shut down their platform on December 1st, 2025.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27027</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-27027">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Everon OCPP Backends</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Everon</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Everon api.everon.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Everon has shut down their platform on December 1st, 2025.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-03</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-03</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24618
title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
release_date: Tue, 03 Mar 26 12:00:00 +0000
ingested_at: 2026-03-05 13:31:06
description:
  <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-21385" target="_blank">CVE-2026-21385</a> Qualcomm Multiple Chipsets Memory Corruption Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-22719" target="_blank">CVE-2026-22719</a> Broadcom VMware Aria Operations Command Injection Vulnerability</li>
  </ul>
  <p>These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">KEV Catalog vulnerabilities</a> as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities" data-entity-type="node" data-entity-uuid="f2adba9a-0404-494c-a90c-4363a4a5c934" data-entity-substitution="canonical" title="Reducing the Significant Risk of Known Exploited Vulnerabilities">specified criteria</a>.</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/03/03/cisa-adds-two-known-exploited-vulnerabilities-catalog


iava_id: /node/24600
title: SWITCH EV swtchenergy.com
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.</strong></p>
  <p>The following versions of SWITCH EV swtchenergy.com are affected:</p>
  <ul>
  <li>swtchenergy.com vers:all/* (CVE-2026-27767, CVE-2026-25113, CVE-2026-25778, CVE-2026-27773)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>SWITCH EV</td>
  <td>SWITCH EV swtchenergy.com</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27767</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27767">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>SWITCH EV swtchenergy.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>SWITCH EV</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SWITCH EV swtchenergy.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>SWITCH EV did not respond to CISA's request for coordination. Contact SWITCH EV using their contact page here: https://swtchenergy.com/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25113</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25113">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>SWITCH EV swtchenergy.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>SWITCH EV</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SWITCH EV swtchenergy.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>SWITCH EV did not respond to CISA's request for coordination. Contact SWITCH EV using their contact page here: https://swtchenergy.com/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25778</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25778">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>SWITCH EV swtchenergy.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>SWITCH EV</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SWITCH EV swtchenergy.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>SWITCH EV did not respond to CISA's request for coordination. Contact SWITCH EV using their contact page here: https://swtchenergy.com/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27773</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27773">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>SWITCH EV swtchenergy.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>SWITCH EV</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SWITCH EV swtchenergy.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>SWITCH EV did not respond to CISA's request for coordination. Contact SWITCH EV using their contact page here: https://swtchenergy.com/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24605
title: Chargemap chargemap.com
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of Chargemap chargemap.com are affected:</p>
  <ul>
  <li>chargemap.com vers:all/* (CVE-2026-25851, CVE-2026-20792, CVE-2026-25711, CVE-2026-20791)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>Chargemap</td>
  <td>Chargemap chargemap.com</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>France</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25851</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25851">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Chargemap chargemap.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Chargemap</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Chargemap chargemap.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Chargemap did not respond to CISA's request for coordination. Contact Chargemap using their contact page here: https://chargemap.com/en-us/support for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20792</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20792">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Chargemap chargemap.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Chargemap</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Chargemap chargemap.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Chargemap did not respond to CISA's request for coordination. Contact Chargemap using their contact page here: https://chargemap.com/en-us/support for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25711</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25711">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Chargemap chargemap.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Chargemap</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Chargemap chargemap.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Chargemap did not respond to CISA's request for coordination. Contact Chargemap using their contact page here: https://chargemap.com/en-us/support for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20791</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20791">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Chargemap chargemap.com</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Chargemap</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Chargemap chargemap.com: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Chargemap did not respond to CISA's request for coordination. Contact Chargemap using their contact page here: https://chargemap.com/en-us/support for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24599
title: EV2GO ev2go.io
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-04.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.</strong></p>
  <p>The following versions of EV2GO ev2go.io are affected:</p>
  <ul>
  <li>ev2go.io vers:all/* (CVE-2026-24731, CVE-2026-25945, CVE-2026-20895, CVE-2026-22890)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>EV2GO</td>
  <td>EV2GO ev2go.io</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United Kingdom</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24731</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24731">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV2GO ev2go.io</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV2GO</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV2GO ev2go.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV2GO did not respond to CISA's request for coordination. Contact EV2GO using their contact page here: https://ev2go.io/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25945</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25945">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV2GO ev2go.io</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV2GO</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV2GO ev2go.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV2GO did not respond to CISA's request for coordination. Contact EV2GO using their contact page here: https://ev2go.io/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20895</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20895">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV2GO ev2go.io</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV2GO</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV2GO ev2go.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV2GO did not respond to CISA's request for coordination. Contact EV2GO using their contact page here: https://ev2go.io/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22890</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-22890">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV2GO ev2go.io</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV2GO</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV2GO ev2go.io: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV2GO did not respond to CISA's request for coordination. Contact EV2GO using their contact page here: https://ev2go.io/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24598
title: CloudCharge cloudcharge.se
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-03
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-03.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.</strong></p>
  <p>The following versions of CloudCharge cloudcharge.se are affected:</p>
  <ul>
  <li>cloudcharge.se vers:all/* (CVE-2026-20781, CVE-2026-25114, CVE-2026-27652, CVE-2026-20733)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>CloudCharge</td>
  <td>CloudCharge cloudcharge.se</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Sweden</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20781</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20781">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>CloudCharge cloudcharge.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>CloudCharge</div>
  <div class="ics-version"><strong>Product Version:</strong><br>CloudCharge cloudcharge.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>CloudCharge did not respond to CISA's request for coordination. Contact CloudCharge using their contact page here: https://cloudcharge.tech/support/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25114</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25114">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>CloudCharge cloudcharge.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>CloudCharge</div>
  <div class="ics-version"><strong>Product Version:</strong><br>CloudCharge cloudcharge.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>CloudCharge did not respond to CISA's request for coordination. Contact CloudCharge using their contact page here: https://cloudcharge.tech/support/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27652</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27652">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>CloudCharge cloudcharge.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>CloudCharge</div>
  <div class="ics-version"><strong>Product Version:</strong><br>CloudCharge cloudcharge.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>CloudCharge did not respond to CISA's request for coordination. Contact CloudCharge using their contact page here: https://cloudcharge.tech/support/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20733</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20733">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>CloudCharge cloudcharge.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>CloudCharge</div>
  <div class="ics-version"><strong>Product Version:</strong><br>CloudCharge cloudcharge.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>CloudCharge did not respond to CISA's request for coordination. Contact CloudCharge using their contact page here: https://cloudcharge.tech/support/contact/ for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24602
title: Mobility46 mobility46.se
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-08.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of Mobility46 mobility46.se are affected:</p>
  <ul>
  <li>mobility46.se vers:all/* (CVE-2026-27028, CVE-2026-26305, CVE-2026-27647, CVE-2026-22878)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>Mobility46</td>
  <td>Mobility46 mobility46.se</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Sweden</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27028</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27028">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobility46 mobility46.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobility46</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobility46 mobility46.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Mobility46 did not respond to CISA's request for coordination. Contact Mobility46 using their contact page here: https://www.mobility46.se/en/contact-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-26305</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-26305">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobility46 mobility46.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobility46</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobility46 mobility46.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Mobility46 did not respond to CISA's request for coordination. Contact Mobility46 using their contact page here: https://www.mobility46.se/en/contact-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27647</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27647">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobility46 mobility46.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobility46</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobility46 mobility46.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Mobility46 did not respond to CISA's request for coordination. Contact Mobility46 using their contact page here: https://www.mobility46.se/en/contact-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22878</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-22878">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Mobility46 mobility46.se</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Mobility46</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Mobility46 mobility46.se: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Mobility46 did not respond to CISA's request for coordination. Contact Mobility46 using their contact page here: https://www.mobility46.se/en/contact-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24597
title: Pelco, Inc. Sarix Pro 3 Series IP Cameras
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-02
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-02.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive device data, bypass surveillance controls, and expose facilities to privacy breaches, operational risks, and regulatory compliance issues.</strong></p>
  <p>The following versions of Pelco, Inc. Sarix Pro 3 Series IP Cameras are affected:</p>
  <ul>
  <li>Sarix Professional IMP 3 Series &lt;=02.52 (CVE-2026-1241)</li>
  <li>Sarix Professional IXP 3 Series &lt;=02.52 (CVE-2026-1241)</li>
  <li>Sarix Professional IBP 3 Series &lt;=02.52 (CVE-2026-1241)</li>
  <li>Sarix Professional IWP 3 Series &lt;=02.52 (CVE-2026-1241)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 7.5</td>
  <td>Pelco, Inc.</td>
  <td>Pelco, Inc. Sarix Pro 3 Series IP Cameras</td>
  <td>Authentication Bypass Using an Alternate Path or Channel</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Commercial Facilities, Defense Industrial Base, Energy, Government Services and Facilities, Healthcare and Public Health, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1241</a></h3>
  <div class="csaf-accordion-content">
  <p>The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1241">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Pelco, Inc. Sarix Pro 3 Series IP Cameras</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Pelco, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Pelco, Inc. Sarix Professional IMP 3 Series: &lt;=02.52, Pelco, Inc. Sarix Professional IXP 3 Series: &lt;=02.52, Pelco, Inc. Sarix Professional IBP 3 Series: &lt;=02.52, Pelco, Inc. Sarix Professional IWP 3 Series: &lt;=02.52</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Pelco, Inc. recommends that all Sarix Professional 3 Series Camera users update their camera firmware to version 02.53 or later. Installing the latest firmware ensures your device receives the most up-to-date bug fixes and critical security enhancements.</p>
  <p><strong>Mitigation</strong><br>More information can be found by visiting Pelco, Inc's technical support page (https://www.pelco.com/support) for assistance.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/288.html">CWE-288 Authentication Bypass Using an Alternate Path or Channel</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Souvik Kandar reported this vulnerability to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24601
title: EV Energy ev.energy
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-07
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-07.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.</strong></p>
  <p>The following versions of EV Energy ev.energy are affected:</p>
  <ul>
  <li>ev.energy vers:all/* (CVE-2026-27772, CVE-2026-24445, CVE-2026-26290, CVE-2026-25774)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.4</td>
  <td>EV Energy</td>
  <td>EV Energy ev.energy</td>
  <td>Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Energy, Transportation Systems</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United Kingdom</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-27772</a></h3>
  <div class="csaf-accordion-content">
  <p>WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-27772">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV Energy ev.energy</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV Energy ev.energy: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV Energy did not respond to CISA's request for coordination. Contact EV Energy using their contact page here: https://www.ev.energy/en-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306 Missing Authentication for Critical Function</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.4</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24445</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24445">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV Energy ev.energy</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV Energy ev.energy: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV Energy did not respond to CISA's request for coordination. Contact EV Energy using their contact page here: https://www.ev.energy/en-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307 Improper Restriction of Excessive Authentication Attempts</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-26290</a></h3>
  <div class="csaf-accordion-content">
  <p>The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-26290">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV Energy ev.energy</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV Energy ev.energy: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV Energy did not respond to CISA's request for coordination. Contact EV Energy using their contact page here: https://www.ev.energy/en-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613 Insufficient Session Expiration</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25774</a></h3>
  <div class="csaf-accordion-content">
  <p>Charging station authentication identifiers are publicly accessible via web-based mapping platforms.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25774">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>EV Energy ev.energy</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>EV Energy</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EV Energy ev.energy: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>EV Energy did not respond to CISA's request for coordination. Contact EV Energy using their contact page here: https://www.ev.energy/en-us for more information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522 Insufficiently Protected Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24603
title: Yokogawa CENTUM VP R6, R7
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-09
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-09.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to terminate the software stack process, cause a denial-of-service condition, or execute arbitrary code.</strong></p>
  <p>The following versions of Yokogawa CENTUM VP R6, R7 are affected:</p>
  <ul>
  <li>Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300) &lt;=R1.07.00 (CVE-2025-1924, CVE-2025-48019, CVE-2025-48020, CVE-2025-48021, CVE-2025-48022, CVE-2025-48023)</li>
  <li>Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300) &lt;=R1.07.00 (CVE-2025-1924, CVE-2025-48019, CVE-2025-48020, CVE-2025-48021, CVE-2025-48022, CVE-2025-48023)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 6.9</td>
  <td>Yokogawa</td>
  <td>Yokogawa CENTUM VP R6, R7</td>
  <td>Out-of-bounds Write, Reachable Assertion, Integer Underflow (Wrap or Wraparound), Improper Handling of Length Parameter Inconsistency</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Food and Agriculture</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Japan</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-1924</a></h3>
  <div class="csaf-accordion-content">
  <p>If the affected product receives maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-1924">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787 Out-of-bounds Write</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.9</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-48019</a></h3>
  <div class="csaf-accordion-content">
  <p>If the affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48019">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/617.html">CWE-617 Reachable Assertion</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-48020</a></h3>
  <div class="csaf-accordion-content">
  <p>If the affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48020">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/617.html">CWE-617 Reachable Assertion</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-48021</a></h3>
  <div class="csaf-accordion-content">
  <p>If theaffected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48021">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/191.html">CWE-191 Integer Underflow (Wrap or Wraparound)</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-48022</a></h3>
  <div class="csaf-accordion-content">
  <p>If the affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48022">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/130.html">CWE-130 Improper Handling of Length Parameter Inconsistency</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-48023</a></h3>
  <div class="csaf-accordion-content">
  <p>If the affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48023">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Yokogawa CENTUM VP R6, R7</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Yokogawa</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Yokogawa Vnet/IP Interface Package for CENTUM VP R6 (VP6C3300): &lt;=R1.07.00, Yokogawa Vnet/IP Interface Package for CENTUM VP R7 (VP7C3300): &lt;=R1.07.00</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users apply patch software (R1.08.00).</p>
  <p><strong>Mitigation</strong><br>Yokogawa recommends users contact a local supporting office for further information or support. https://contact.yokogawa.com/cs/gw?c-id=000498</p>
  <p><strong>Mitigation</strong><br>For more information and details on implementing these mitigations, users should see the Yokogawa advisory YSAR-26-0002 at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/617.html">CWE-617 Reachable Assertion</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Dmitry Sklyar and Demid Uzenkov of Positive Technologies reported these vulnerabilities to Yokogawa</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. These vulnerabilities have a high attack complexity.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Republication of YSAR-26-0002</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24604
title: Copeland XWEB and XWEB Pro
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.</strong></p>
  <p>The following versions of Copeland XWEB and XWEB Pro are affected:</p>
  <ul>
  <li>XWEB 300D PRO &lt;=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)</li>
  <li>XWEB 500D PRO &lt;=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)</li>
  <li>XWEB 500B PRO &lt;=1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663, CVE-2026-21389, CVE-2026-25111, CVE-2026-20742, CVE-2026-24517, CVE-2026-25195, CVE-2026-20910, CVE-2026-24689, CVE-2026-25109, CVE-2026-20902, CVE-2026-24695, CVE-2026-25105, CVE-2026-24452, CVE-2026-23702, CVE-2026-25721, CVE-2026-20764, CVE-2026-25196, CVE-2026-25037, CVE-2026-22877, CVE-2026-20797, CVE-2026-3037)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 10</td>
  <td>Copeland</td>
  <td>Copeland XWEB and XWEB Pro</td>
  <td>Unexpected Status Code or Return Value, Use of a Broken or Risky Cryptographic Algorithm, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Stack-based Buffer Overflow</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Commercial Facilities</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25085</a></h3>
  <div class="csaf-accordion-content">
  <p>A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25085">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/394.html">CWE-394 Unexpected Status Code or Return Value</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.6</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21718</a></h3>
  <div class="csaf-accordion-content">
  <p>An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21718">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/327.html">CWE-327 Use of a Broken or Risky Cryptographic Algorithm</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>10</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24663</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24663">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21389</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21389">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25111</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25111">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20742</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the templates route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20742">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24517</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24517">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25195</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25195">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20910</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to achieve remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20910">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24689</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24689">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25109</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route, leading to remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25109">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20902</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20902">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24695</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility route, leading to remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24695">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25105</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25105">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-24452</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-24452">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-23702</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfiguration action in the API V1 route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-23702">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25721</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25721">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20764</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20764">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25196</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi-Fi SSID and/or password fields can lead to remote code execution when the configuration is processed.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25196">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-25037</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-25037">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22877</a></h3>
  <div class="csaf-accordion-content">
  <p>An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-22877">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>3.7</td>
  <td>LOW</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-20797</a></h3>
  <div class="csaf-accordion-content">
  <p>A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-20797">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/121.html">CWE-121 Stack-based Buffer Overflow</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-3037</a></h3>
  <div class="csaf-accordion-content">
  <p>An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-3037">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Copeland XWEB and XWEB Pro</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Copeland</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Copeland XWEB 300D PRO: &lt;=1.12.1, Copeland XWEB 500D PRO: &lt;=1.12.1, Copeland XWEB 500B PRO: &lt;=1.12.1</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Copeland has provided a fix for the vulnerabilities and recommends users update the XWEB Pro to the latest version by going to their software update page https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate in the sections dedicated to the different XWEBPRO models page.</p>
  <p><strong>Mitigation</strong><br>Alternatively, a user logged into an XWEB Pro with internet access can update XWEB Pro directly from Copeland servers via the menu SYSTEM -- Updates | Network.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Amir Zaltzman and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
  <p>Do not click web links or open attachments in unsolicited email messages.</p>
  <p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
  <p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24596
title: Johnson Controls, Inc. Frick Controls Quantum HD
release_date: Thu, 26 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities can lead to pre-authentication remote code execution, information leak or denial of service.</strong></p>
  <p>The following versions of Johnson Controls, Inc. Frick Controls Quantum HD are affected:</p>
  <ul>
  <li>Frick Controls Quantum HD &lt;=10.22 (CVE-2026-21654, CVE-2026-21656, CVE-2026-21657, CVE-2026-21658, CVE-2026-21659, CVE-2026-21660)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.1</td>
  <td>Johnson Controls, Inc.</td>
  <td>Johnson Controls, Inc. Frick Controls Quantum HD</td>
  <td>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Control of Generation of Code ('Code Injection'), Relative Path Traversal, Plaintext Storage of a Password</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Food and Agriculture</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Ireland</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21654</a></h3>
  <div class="csaf-accordion-content">
  <p>The Frick Controls Quantum HD is vulnerable due to insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21654">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21656</a></h3>
  <div class="csaf-accordion-content">
  <p>The Frick Controls Quantum HD is vulnerable due to insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21656">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94 Improper Control of Generation of Code ('Code Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21657</a></h3>
  <div class="csaf-accordion-content">
  <p>The Frick Controls Quantum HD is vulnerable due to insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21657">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94 Improper Control of Generation of Code ('Code Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21658</a></h3>
  <div class="csaf-accordion-content">
  <p>The Frick Controls Quantum HD is vulnerable due to insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21658">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94 Improper Control of Generation of Code ('Code Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21659</a></h3>
  <div class="csaf-accordion-content">
  <p>The Frick Controls Quantum HD contains a vulnerability that allows an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21659">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/23.html">CWE-23 Relative Path Traversal</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21660</a></h3>
  <div class="csaf-accordion-content">
  <p>Hardcoded credentials in the Frick Controls Quantum HD create a vulnerability that leads to unauthorized access, exposure of sensitive information, and potential misuse or system compromise.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21660">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Johnson Controls, Inc. Frick Controls Quantum HD</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls, Inc.</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls, Inc. Frick Controls Quantum HD: &lt;=10.22</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The Frick Controls Quantum HD, versions 10.22 through 11, are legacy platforms that have reached end of support. Johnson Controls, Inc. recommends upgrading to the latest platform, Quantum HD Unity, version 12 or higher. The update procedure can be found here (https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf?sv=2018-03-28&amp;si=frickweb1-174C1294FA7&amp;sr=f&amp;sig=us0dhk6IWmCvmDvBs02yJvC%2BjnzbxqZmb4QEpVVDkxY%3D).</p>
  <p><strong>Mitigation</strong><br>After completing the upgrade to version 12, verify full compliance with the hardening guide and apply all recommended security configurations.</p>
  <p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-05 at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/256.html">CWE-256 Plaintext Storage of a Password</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.2</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Noam Moshe of Claroty Research Team 82 reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-26</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-26</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24595
title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
release_date: Wed, 25 Feb 26 12:00:00 +0000
ingested_at: 2026-03-05 13:31:06
description:
  <p>CISA has added&nbsp;two&nbsp;new&nbsp;vulnerabilities&nbsp;to its&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.&nbsp;</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2022-20775" target="_blank">CVE-2022-20775</a>&nbsp;Cisco&nbsp;Catalyst&nbsp;SD-WAN Path Traversal Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-20127" target="_blank">CVE-2026-20127</a>&nbsp;Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability&nbsp;</li>
  </ul>
  <p>These&nbsp;types&nbsp;of vulnerabilities&nbsp;are&nbsp;frequent attack vectors&nbsp;for malicious cyber actors and pose&nbsp;significant risks to the federal enterprise.&nbsp;</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a>&nbsp;established the KEV&nbsp;Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the&nbsp;<a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a>&nbsp;for more information.&nbsp;</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing&nbsp;timely&nbsp;remediation of&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">KEV Catalog vulnerabilities</a>&nbsp;as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities">specified criteria</a>.</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-adds-two-known-exploited-vulnerabilities-catalog


iava_id: /node/24589
title: CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems
release_date: Wed, 25 Feb 26 12:00:00 +0000
ingested_at: 2026-03-05 13:31:06
description:
  <p><em>The purpose of this Alert is to provide resources for organizations with Cisco Software-Defined Wide-Area Networking (SD-WAN) systems, including Federal Civilian Executive Branch (FCEB) agencies, to address ongoing exploitation of multiple vulnerabilities. Notably, the Cybersecurity and Infrastructure Security Agency (CISA) has added&nbsp;</em><a href="https://www.cve.org/CVERecord?id=CVE-2026-20127" target="_blank"><em>CVE-2026-20127</em></a><em> and&nbsp;</em><a href="https://www.cve.org/CVERecord?id=CVE-2022-20775" target="_blank"><em>CVE-2022-20775</em></a><em> to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 25, 2026. As a result of the malicious cyber activity and vulnerabilities involving Cisco SD-WAN systems, CISA has outlined requirements for FCEB agencies in Emergency Directive (ED) 26-03 to inventory Cisco SD-WAN systems, update them, and assess compromise.</em></p>
  <p>CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems.</p>
  <p>CISA, National Security Agency (NSA), and international partners Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (Cyber Centre), New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK), hereafter the “authoring organizations,” strongly urge network defenders to immediately 1) inventory all in-scope Cisco SD-WAN systems, 2) collect artifacts, including virtual snapshots and logs off of SD-WAN systems to support threat hunt activities, 3) fully patch Cisco SD-WAN systems with available updates, 4) hunt for evidence of compromise, and 5) concurrently review Cisco’s latest security advisories, <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk" target="_blank">Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability</a> and <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v" target="_blank">Cisco Catalyst SD-WAN Vulnerabilities</a>, and implement <a href="https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide" target="_blank">Cisco’s SD-WAN Hardening Guidance</a>.<a href="#note1"><sup>1</sup></a></p>
  <p>To address malicious activity involving vulnerable Cisco SD-WAN systems, CISA issued <a href="https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems">Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems</a>, which outlines requirements for FCEB agencies to inventory Cisco SD-WAN systems, update them, and assess compromise. Further, CISA released <a href="https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems">Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems</a> to provide prescriptive actions for FCEB agencies.&nbsp;</p>
  <p>Cisco’s Catalyst SD-WAN Hardening Guide recommends that network defenders address:</p>
  <ul>
  <li><strong>Network perimeter controls</strong>: Ensure control components are behind a firewall, isolate virtual private network (VPN) 512 interfaces, and use internet protocol (IP) blocks for manually provisioned edge IPs.</li>
  <li><strong>SD-WAN manager access</strong>: Replace the self-signed certificate for the web user interface.</li>
  <li><strong>Control and data plane security</strong>: Use pairwise keys.</li>
  <li><strong>Session timeout</strong>: Limit to the shortest period possible.</li>
  <li><strong>Logging</strong>: Forward to a remote syslog server.</li>
  </ul>
  <p>CISA and the authoring organizations are providing the following resources: &nbsp;</p>
  <ul>
  <li>CISA: <a href="https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems">Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems</a></li>
  <li>CISA: <a href="https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems">Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems</a></li>
  <li>Cisco: <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk" target="_blank">Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability</a></li>
  <li>Cisco: <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v" target="_blank">Cisco Catalyst SD-WAN Vulnerabilities</a></li>
  <li>Cisco: <a href="https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide" target="_blank">Cisco Catalyst SD-WAN Hardening Guide</a></li>
  <li>ASD’s ACSC: <a href="https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf" target="_blank">Cisco SD-WAN Threat Hunt Guide</a>, co-sealed by CISA, NSA, Cyber Centre, NCSC-NZ, and NCSC-UK. This guide, based on investigative data, supports network defenders’ detection of and response to the malicious actors’ threat activity</li>
  </ul>
  <h2><strong>Acknowledgements</strong></h2>
  <p>NSA, ASD’s ACSC, Cyber Centre, NCSC-NZ, and NCSC-UK contributed to this alert<strong>.</strong></p>
  <h2><strong>Disclaimer</strong></h2>
  <p>The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. </p>
  <h2><strong>Notes</strong>&nbsp;</h2>
  <p><a class="ck-anchor" id="note1">1</a> Cisco Security, “Cisco Catalyst SD-WAN Hardening Guide,” last modified February 9, 2026, <a href="https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide" target="_blank">https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide</a></p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems


iava_id: /node/24585
title: CISA Adds One Known Exploited Vulnerability to Catalog
release_date: Tue, 24 Feb 26 12:00:00 +0000
ingested_at: 2026-03-05 13:31:06
description:
  <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-25108" target="_blank">CVE-2026-25108</a> Soliton Systems K.K. FileZen OS Command Injection Vulnerability</li>
  </ul>
  <p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">KEV Catalog vulnerabilities</a> as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities" data-entity-type="node" data-entity-uuid="f2adba9a-0404-494c-a90c-4363a4a5c934" data-entity-substitution="canonical" title="Reducing the Significant Risk of Known Exploited Vulnerabilities">specified criteria</a>.</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/02/24/cisa-adds-one-known-exploited-vulnerability-catalog


iava_id: /node/24583
title: Schneider Electric EcoStruxure Building Operation Workstation
release_date: Tue, 24 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-02
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-02.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Schneider Electric is aware of a vulnerability in EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation. [EcoStruxure Building Operation (EBO)](https://www.se.com/ww/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers valuable data for decision-making to improve energy management and increase efficiency for better building performance and comfort, reduced carbon, and more sustainable building environments. Failure to apply the remediations below may risk exposure of local files or denial of service, which could result in data breaches, and operational disruptions.</strong></p>
  <p>The following versions of Schneider Electric EcoStruxure Building Operation Workstation are affected:</p>
  <ul>
  <li>EcoStruxure Building Operation Workstation vers:generic/&gt;=7.0.x|&lt;7.0.3.2000_(CP1), 7.0.3.2000_CP1, vers:generic/&gt;=6.x|&lt;6.0.4.14001_(CP10), 6.0.4.14001_CP10, vers:intdot/&gt;=7.0.x|&lt;7.0.2, 7.0.2, vers:generic/&gt;=6.0.x|&lt;6.0.4.7000_(CP5), 6.0.4.7000_CP5 (CVE-2026-1227, CVE-2026-1227, CVE-2026-1226, CVE-2026-1226)</li>
  <li>EcoStruxure Building Operation WebStation vers:generic/&gt;=7.0.x|&lt;7.0.3.2000_(CP1), 7.0.3.2000_CP1, vers:generic/&gt;=6.x|&lt;6.0.4.14001_(CP10), 6.0.4.14001_CP10, vers:intdot/&gt;=7.0.x|&lt;7.0.2, 7.0.2, vers:generic/&gt;=6.0.x|&lt;6.0.4.7000_(CP5), 6.0.4.7000_CP5 (CVE-2026-1227, CVE-2026-1227, CVE-2026-1226, CVE-2026-1226)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 7.3</td>
  <td>Schneider Electric</td>
  <td>Schneider Electric EcoStruxure Building Operation Workstation</td>
  <td>Improper Restriction of XML External Entity Reference, Improper Control of Generation of Code ('Code Injection')</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Commercial Facilities, Energy, Government Services and Facilities, Healthcare and Public Health, Information Technology, Transportation Systems, Financial Services, Defense Industrial Base, Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>France</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1227</a></h3>
  <div class="csaf-accordion-content">
  <p>An improper restriction of XML external entity reference vulnerability exists that could result in unauthorized disclosure of local files, unauthorized interaction with the EBO system, or denial-of-service conditions. This occurs when a local user uploads a maliciously crafted TGML graphics file to the EBO server from Workstation.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1227">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Schneider Electric EcoStruxure Building Operation Workstation</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Schneider Electric</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EcoStruxure Building Operation Workstation All 7.0.x versions prior to 7.0.3.2000 (CP1), EcoStruxure Building Operation Workstation All 6.x versions prior to 6.0.4.14001 (CP10), EcoStruxure Building Operation WebStation All 7.0.x versions prior to 7.0.3.2000 (CP1), EcoStruxure Building Operation WebStation All 6.x versions prior to 6.0.4.14001 (CP10)</div>
  <div class="ics-status"><strong>Product Status:</strong><br>fixed, known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The following versions of EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation include a fix for CVE-2026-1227: • 7.0.3.2000 (CP1) Step 1: Navigate to this link: https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v7-0 Step 2: Download 'EcoStruxure Building Operation Patch v7.0' Step 3: Follow the installation instructions provided in the accompanying readme file. Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Vendor fix</strong><br>The following versions of EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation includes a fix for CVE-2026-1227: • 6.0.4.14001 (CP10) Step 1: Locate the appropriate version for your system here: https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v6-0 Step 2: Download ‘EcoStruxure Building Operation Patch v6.0‘ Step 3: Follow the installation instructions provided in the accompanying readme file. Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Mitigation</strong><br>If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Implement strong access controls to limit system access to authorized personnel. • Use multi factor authentication if using EBO version 7.0 or later. • Use firewalls to segregate networks and protect the building management system. • Regularly monitor system activity. • Ensure you are following [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Schneider Electric security advisory SEVD-2026-041-02, titled ‘Multiple Vulnerabilities on EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation‘. • PDF Version: [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=SEVD-2026-041-02.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=SEVD-2026-041-02.pdf) • CSAF Version: [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=sevd-2026-041-02.json](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=sevd-2026-041-02.json).</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/611.html">CWE-611 Improper Restriction of XML External Entity Reference</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-1226</a></h3>
  <div class="csaf-accordion-content">
  <p>An improper control of generation of code vulnerability exists that could result in the execution of untrusted or unintended code within the application. This occurs when maliciously crafted design content is processed through a TGML graphics file.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-1226">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Schneider Electric EcoStruxure Building Operation Workstation</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Schneider Electric</div>
  <div class="ics-version"><strong>Product Version:</strong><br>EcoStruxure Building Operation Workstation All 7.0.x versions prior to 7.0.2, EcoStruxure Building Operation Workstation All 6.0.x versions prior to 6.0.4.7000 (CP5), EcoStruxure Building Operation Webstation All 7.0.x versions prior to 7.0.2, EcoStruxure Building Operation Webstation All 6.0.x versions prior to 6.0.4.7000 (CP5)</div>
  <div class="ics-status"><strong>Product Status:</strong><br>fixed, known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>The following versions of EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation include a fix for CVE-2026-1226:&nbsp; • 7.0.2 Step 1: Navigate to this link: https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v7-0 Step 2: Download 'EcoStruxure Building Operation Patch v7.0' Step 3: Follow the installation instructions provided in the accompanying readme file. Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Vendor fix</strong><br>The following versions of EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation includes a fix for CVE-2026-1226: • 6.0.4.7000 (CP5) Step 1: Locate the appropriate version for your system here: https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v6-0 Step 2: Download ‘EcoStruxure Building Operation Patch v6.0‘ Step 3: Follow the installation instructions provided in the accompanying readme file. Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Mitigation</strong><br>If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Implement strong access controls to limit system access to authorized personnel. • Use multi factor authentication if using EBO version 7.0 or later. • Use firewalls to segregate networks and protect the building management system. • Regularly monitor system activity. • Ensure you are following [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&amp;productversion=7.1&amp;locale=en-US).</p>
  <p><strong>Mitigation</strong><br>For more information see the associated Schneider Electric security advisory SEVD-2026-041-02, titled "Multiple Vulnerabilities on EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation". • PDF Version: [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=SEVD-2026-041-02.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=SEVD-2026-041-02.pdf) • CSAF Version: [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=sevd-2026-041-02.json](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=sevd-2026-041-02.json).</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94 Improper Control of Generation of Code ('Code Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Pentest Limited reported these vulnerabilities to Schneider Electric.</li>
  <li>Robin Plugge reported these vulnerabilities to Schneider Electric.</li>
  </ul>
  <hr>
  <h2>General Security Recommendations</h2>
  <p>We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the “Program” mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.</p>
  <hr>
  <h2>For More Information</h2>
  <p>This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp</p>
  <hr>
  <h2>LEGAL DISCLAIMER</h2>
  <p>THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION</p>
  <hr>
  <h2>About Schneider Electric</h2>
  <p>Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in sustainability and efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability: * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. (https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf)</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. (https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf)</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Schneider Electric SEVD-2026-041-02 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-10</td>
  <td>1</td>
  <td>Original Release</td>
  </tr>
  <tr>
  <td>2026-02-24</td>
  <td>2</td>
  <td>Initial CISA Republication of Schneider Electric SEVD-2026-041-02 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24582
title: InSAT MasterSCADA BUK-TS
release_date: Tue, 24 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-01.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities may allow remote code execution.</strong></p>
  <p>The following versions of InSAT MasterSCADA BUK-TS are affected:</p>
  <ul>
  <li>MasterSCADA BUK-TS vers:all/* (CVE-2026-21410, CVE-2026-22553)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.8</td>
  <td>InSAT</td>
  <td>InSAT MasterSCADA BUK-TS</td>
  <td>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Water and Wastewater</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Russia</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-21410</a></h3>
  <div class="csaf-accordion-content">
  <p>InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-21410">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>InSAT MasterSCADA BUK-TS</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>InSAT</div>
  <div class="ics-version"><strong>Product Version:</strong><br>InSAT MasterSCADA BUK-TS: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.</p>
  <p><strong>Mitigation</strong><br>InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22553</a></h3>
  <div class="csaf-accordion-content">
  <p>All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-22553">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>InSAT MasterSCADA BUK-TS</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>InSAT</div>
  <div class="ics-version"><strong>Product Version:</strong><br>InSAT MasterSCADA BUK-TS: vers:all/*</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.</p>
  <p><strong>Mitigation</strong><br>InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.8</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Adem El Adeb reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-24</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-24</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24584
title: Gardyn Home Kit
release_date: Tue, 24 Feb 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
ingested_at: 2026-03-05 13:31:06
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control edge devices, access cloud-based devices and user information without authentication, and pivot to other edge devices managed in the Gardyn cloud environment.</strong></p>
  <p>The following versions of Gardyn Home Kit are affected:</p>
  <ul>
  <li>Home Kit Firmware</li>
  <li>Gardyn Home Kit Mobile Application &lt;2.11.0 (CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2025-1242)</li>
  <li>Gardyn Home Kit Cloud API &lt;2.12.2026 (CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2025-1242)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 9.1</td>
  <td>Gardyn</td>
  <td>Gardyn Home Kit</td>
  <td>Cleartext Transmission of Sensitive Information, Use of Default Credentials, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Food and Agriculture</li>
  <li><strong>Countries/Areas Deployed: </strong>United States</li>
  <li><strong>Company Headquarters Location: </strong>United States</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-29628</a></h3>
  <div class="csaf-accordion-content">
  <p>A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29628">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Gardyn Home Kit</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Gardyn</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Gardyn Home Kit Firmware: &lt;master.619, Gardyn Gardyn Home Kit Mobile Application: &lt;2.11.0, Gardyn Gardyn Home Kit Cloud API: &lt;2.12.2026</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices.</p>
  <p><strong>Mitigation</strong><br>The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.</p>
  <p><strong>Mitigation</strong><br>For all vulnerabilities, Gardyn recommends users ensure their home kit devices are upgraded to firmware master.619 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their home kits have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.</p>
  <p><strong>Mitigation</strong><br>Further information on Gardyn security can be found here: https://mygardyn.com/security/</p>
  <p><strong>Mitigation</strong><br>Further customer support can be obtained from Gardyn at: support@mygardyn.com</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/319.html">CWE-319 Cleartext Transmission of Sensitive Information</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-29629</a></h3>
  <div class="csaf-accordion-content">
  <p>The Gardyn Home Kit uses weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29629">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Gardyn Home Kit</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Gardyn</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Gardyn Home Kit Firmware: &lt;master.619, Gardyn Gardyn Home Kit Mobile Application: &lt;2.11.0, Gardyn Gardyn Home Kit Cloud API: &lt;2.12.2026</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices.</p>
  <p><strong>Mitigation</strong><br>The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.</p>
  <p><strong>Mitigation</strong><br>For all vulnerabilities, Gardyn recommends users ensure their home kit devices are upgraded to firmware master.619 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their home kits have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.</p>
  <p><strong>Mitigation</strong><br>Further information on Gardyn security can be found here: https://mygardyn.com/security/</p>
  <p><strong>Mitigation</strong><br>Further customer support can be obtained from Gardyn at: support@mygardyn.com</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/1392.html">CWE-1392 Use of Default Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.3</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-29631</a></h3>
  <div class="csaf-accordion-content">
  <p>The Gardyn Home Kit is vulnerable to command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-29631">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Gardyn Home Kit</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Gardyn</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Gardyn Home Kit Firmware: &lt;master.619, Gardyn Gardyn Home Kit Mobile Application: &lt;2.11.0, Gardyn Gardyn Home Kit Cloud API: &lt;2.12.2026</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices.</p>
  <p><strong>Mitigation</strong><br>The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.</p>
  <p><strong>Mitigation</strong><br>For all vulnerabilities, Gardyn recommends users ensure their home kit devices are upgraded to firmware master.619 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their home kits have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.</p>
  <p><strong>Mitigation</strong><br>For CVE-2025-29631: Gardyn is currently working on a full mitigation to address this vulnerability. As previously stated, Gardyn recommends that users ensure their devices are always updated to the most current firmware version.</p>
  <p><strong>Mitigation</strong><br>Further information on Gardyn security can be found here: https://mygardyn.com/security/</p>
  <p><strong>Mitigation</strong><br>Further customer support can be obtained from Gardyn at: support@mygardyn.com</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-1242</a></h3>
  <div class="csaf-accordion-content">
  <p>The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-1242">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Gardyn Home Kit</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Gardyn</div>
  <div class="ics-version"><strong>Product Version:</strong><br>Gardyn Home Kit Firmware: &lt;master.619, Gardyn Gardyn Home Kit Mobile Application: &lt;2.11.0, Gardyn Gardyn Home Kit Cloud API: &lt;2.12.2026</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Mitigation</strong><br>Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices.</p>
  <p><strong>Mitigation</strong><br>The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.</p>
  <p><strong>Mitigation</strong><br>For all vulnerabilities, Gardyn recommends users ensure their home kit devices are upgraded to firmware master.619 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their home kits have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.</p>
  <p><strong>Mitigation</strong><br>Further information on Gardyn security can be found here: https://mygardyn.com/security/</p>
  <p><strong>Mitigation</strong><br>Further customer support can be obtained from Gardyn at: support@mygardyn.com</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798 Use of Hard-coded Credentials</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>9.1</td>
  <td>CRITICAL</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Michael Groberman reported these vulnerabilities to CISA</li>
  </ul>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:</p>
  <p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
  <p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
  <hr>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-02-24</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-02-24</td>
  <td>1</td>
  <td>Initial Publication</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


iava_id: /node/24576
title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
release_date: Fri, 20 Feb 26 12:00:00 +0000
ingested_at: 2026-03-05 13:31:06
description:
  <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
  <ul>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-49113" target="_blank">CVE-2025-49113</a> RoundCube Webmail Deserialization of Untrusted Data Vulnerability</li>
  <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-68461" target="_blank">CVE-2025-68461</a> RoundCube Webmail Cross-site Scripting Vulnerability</li>
  </ul>
  <p>These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.</p>
  <p><a href="https://www.cisa.gov/binding-operational-directive-22-01">Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</a> established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the <a href="https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf">BOD 22-01 Fact Sheet</a> for more information.</p>
  <p>Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" data-entity-type="node" data-entity-uuid="79453b83-86b9-4e2f-b1ec-abf73c6eb291" data-entity-substitution="canonical" title="Known Exploited Vulnerabilities Catalog">KEV Catalog vulnerabilities</a> as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the <a href="https://www.cisa.gov/known-exploited-vulnerabilities" data-entity-type="node" data-entity-uuid="f2adba9a-0404-494c-a90c-4363a4a5c934" data-entity-substitution="canonical" title="Reducing the Significant Risk of Known Exploited Vulnerabilities">specified criteria</a>.&nbsp;</p>

source_url:
  https://www.cisa.gov/news-events/alerts/2026/02/20/cisa-adds-two-known-exploited-vulnerabilities-catalog


iava_id: /node/24640
title: Siemens SIDIS Prime
release_date: Thu, 12 Mar 26 12:00:00 +0000
source_url: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-03
ingested_at: 2026-03-12 18:23:56
description:
  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-071-03.json"><strong>View CSAF</strong></a></p>
  <h2>Summary</h2>
  <p><strong>SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.</strong></p>
  <p>The following versions of Siemens SIDIS Prime are affected:</p>
  <ul>
  <li>SIDIS Prime vers:intdot/&lt;4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-2025-62522, CVE-2025-64718, CVE-2025-64756, CVE-2025-66030, CVE-2025-66031, CVE-2025-66035, CVE-2025-66412, CVE-2025-69277, CVE-2026-22610)</li>
  </ul>
  <div class="csaf-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
  <th role="columnheader">Vendor</th>
  <th role="columnheader">Equipment</th>
  <th role="columnheader">Vulnerabilities</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>v3 8.7</td>
  <td>Siemens</td>
  <td>Siemens SIDIS Prime</td>
  <td>Out-of-bounds Read, Observable Discrepancy, Improper Input Validation, Improper Certificate Validation, Numeric Truncation Error, Use of Insufficiently Random Values, Out-of-bounds Write, Inefficient Regular Expression Complexity, Interpretation Conflict, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal, Allocation of Resources Without Limits or Throttling, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Integer Overflow or Wraparound, Uncontrolled Recursion, Insertion of Sensitive Information Into Sent Data, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Incomplete List of Disallowed Inputs</td>
  </tr>
  </tbody>
  </table>
  </div>
  <h3>Background</h3>
  <ul>
  <li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
  <li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
  <li><strong>Company Headquarters Location: </strong>Germany</li>
  </ul>
  <hr>
  <h2>Vulnerabilities</h2>
  <div class="csaf-accordion">
  <p><a class="csaf-accordion-toggle-all" href="#">Expand All +</a></p>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2024-29857</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125 Out-of-bounds Read</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2024-30171</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/203.html">CWE-203 Observable Discrepancy</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.9</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2024-30172</a></h3>
  <div class="csaf-accordion-content">
  <p>An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20 Improper Input Validation</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2024-41996</a></h3>
  <div class="csaf-accordion-content">
  <p>Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-41996">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295 Improper Certificate Validation</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-6965</a></h3>
  <div class="csaf-accordion-content">
  <p>There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-6965">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/197.html">CWE-197 Numeric Truncation Error</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.7</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-7783</a></h3>
  <div class="csaf-accordion-content">
  <p>Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: &lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-7783">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/330.html">CWE-330 Use of Insufficiently Random Values</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.7</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-9230</a></h3>
  <div class="csaf-accordion-content">
  <p>An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-9230">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787 Out-of-bounds Write</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.6</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-9232</a></h3>
  <div class="csaf-accordion-content">
  <p>Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-9232">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125 Out-of-bounds Read</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.9</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-9670</a></h3>
  <div class="csaf-accordion-content">
  <p>A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-9670">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/1333.html">CWE-1333 Inefficient Regular Expression Complexity</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-12816</a></h3>
  <div class="csaf-accordion-content">
  <p>An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-12816">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/436.html">CWE-436 Interpretation Conflict</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.6</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-15284</a></h3>
  <div class="csaf-accordion-content">
  <p>Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: &lt; 6.14.1. SummaryThe arrayLimit&nbsp;option in qs does not enforce limits for bracket notation (a[]=1&amp;a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit&nbsp;for DoS protection are vulnerable. DetailsThe arrayLimit&nbsp;option only checks limits for indexed notation (a[0]=1&amp;a[1]=2) but completely bypasses it for bracket notation (a[]=1&amp;a[]=2). Vulnerable code&nbsp;(lib/parse.js:159-162): if (root === '[]' &amp;&amp; options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code&nbsp;(lib/parse.js:175): else if (index &lt;= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf)&nbsp;without validating against options.arrayLimit, while indexed notation at line 175 checks index &lt;= options.arrayLimit&nbsp;before creating arrays. PoCTest 1 - Basic bypass: npm install qs const qs = require('qs'); const result = qs.parse('a[]=1&amp;a[]=2&amp;a[]=3&amp;a[]=4&amp;a[]=5&amp;a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Test 2 - DoS demonstration: const qs = require('qs'); const attack = 'a[]=' + Array(10000).fill('x').join('&amp;a[]='); const result = qs.parse(attack, { arrayLimit: 100 }); console.log(result.a.length); // Output: 10000 (should be max 100) Configuration: * arrayLimit: 5&nbsp;(test 1) or arrayLimit: 100&nbsp;(test 2) * Use bracket notation: a[]=value&nbsp;(not indexed a[0]=value) ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()&nbsp;with user-controlled input and arrayLimit&nbsp;for protection. Attack scenario: * Attacker sends HTTP request: GET /api/search?filters[]=x&amp;filters[]=x&amp;...&amp;filters[]=x&nbsp;(100,000+ times) * Application parses with qs.parse(query, { arrayLimit: 100 }) * qs ignores limit, parses all 100,000 elements into array * Server memory exhausted → application crashes or becomes unresponsive * Service unavailable for all users Real-world impact: * Single malicious request can crash server * No authentication required * Easy to automate and scale * Affects any endpoint parsing query strings with bracket notation</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-15284">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20 Improper Input Validation</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-58751</a></h3>
  <div class="csaf-accordion-content">
  <p>Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58751">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-58752</a></h3>
  <div class="csaf-accordion-content">
  <p>Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58752">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/23.html">CWE-23 Relative Path Traversal</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-58754</a></h3>
  <div class="csaf-accordion-content">
  <p>Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-58754">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/770.html">CWE-770 Allocation of Resources Without Limits or Throttling</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-62522</a></h3>
  <div class="csaf-accordion-content">
  <p>Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-62522">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>6.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-64718</a></h3>
  <div class="csaf-accordion-content">
  <p>js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-64718">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/1321.html">CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-64756</a></h3>
  <div class="csaf-accordion-content">
  <p>Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-64756">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-66030</a></h3>
  <div class="csaf-accordion-content">
  <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66030">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190 Integer Overflow or Wraparound</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>5.3</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-66031</a></h3>
  <div class="csaf-accordion-content">
  <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66031">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674 Uncontrolled Recursion</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>7.5</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-66035</a></h3>
  <div class="csaf-accordion-content">
  <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66035">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/201.html">CWE-201 Insertion of Sensitive Information Into Sent Data</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8.6</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-66412</a></h3>
  <div class="csaf-accordion-content">
  <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66412">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2025-69277</a></h3>
  <div class="csaf-accordion-content">
  <p>libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-69277">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/184.html">CWE-184 Incomplete List of Disallowed Inputs</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>4.5</td>
  <td>MEDIUM</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N">CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  <div class="csaf-accordion-item">
  <h3><a class="csaf-accordion-toggle" href="#">CVE-2026-22610</a></h3>
  <div class="csaf-accordion-content">
  <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.</p>
  <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-22610">View CVE Details</a></p>
  <hr>
  <h4>Affected Products</h4>
  <h5>Siemens SIDIS Prime</h5>
  <div class="ics-vendor-version-status">
  <div class="ics-vendor"><strong>Vendor:</strong><br>Siemens</div>
  <div class="ics-version"><strong>Product Version:</strong><br>SIDIS Prime</div>
  <div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
  </div>
  <div class="ics-remediations">
  <h6>Remediations</h6>
  <p><strong>Vendor fix</strong><br>Update to V4.0.800 or later version</p>
  </div>
  <p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</a></p>
  <hr>
  <h4>Metrics</h4>
  <div class="csaf-table csaf-metrics-table">
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
  <th role="columnheader">Base Score</th>
  <th role="columnheader">Base Severity</th>
  <th role="columnheader">Vector String</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>3.1</td>
  <td>8</td>
  <td>HIGH</td>
  <td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</a></td>
  </tr>
  </tbody>
  </table>
  </div>
  </div>
  </div>
  </div>
  <hr>
  <h2>Acknowledgments</h2>
  <ul>
  <li>Siemens ProductCERT reported these vulnerabilities to CISA.</li>
  </ul>
  <hr>
  <h2>General Recommendations</h2>
  <p>As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity</p>
  <hr>
  <h2>Additional Resources</h2>
  <p>For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories</p>
  <hr>
  <h2>Terms of Use</h2>
  <p>The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.</p>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>
  <p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
  <hr>
  <h2>Recommended Practices</h2>
  <p>CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.</p>
  <p>Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.</p>
  <p>Locate control system networks and remote devices behind firewalls and isolate them from business networks.</p>
  <p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.</p>
  <p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
  <p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
  <p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
  <p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
  <hr>
  <h2>Advisory Conversion Disclaimer</h2>
  <p>This ICSA is a verbatim republication of Siemens ProductCERT SSA-485750 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.</p>
  <h2>Revision History</h2>
  <ul>
  <li><strong>Initial Release Date: </strong>2026-03-10</li>
  </ul>
  <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
  <thead>
  <tr>
  <th role="columnheader" data-tablesaw-priority="persist">Date</th>
  <th role="columnheader">Revision</th>
  <th role="columnheader">Summary</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>2026-03-10</td>
  <td>1</td>
  <td>Publication Date</td>
  </tr>
  <tr>
  <td>2026-03-12</td>
  <td>2</td>
  <td>Initial CISA Republication of Siemens ProductCERT SSA-485750 advisory</td>
  </tr>
  </tbody>
  </table>
  <hr>
  <h2>Legal Notice and Terms of Use</h2>


