Do Son Siemens patched a Critical (CVSS 9.8) authentication bypass flaw (CVE-2025-40771) in SIMATIC ET 200SP communication processors, allowing unauthenticated remote access to configuration data.
ICS security
Rockwell issued an urgent fix for a Critical (CVSS 10.0) auth bypass in its 1783-NATR router (CVE-2025-7328). The flaw allows remote admin takeover and configuration disruption.
Rockwell patched a flaw (CVE-2025-9067) in FactoryTalk Linx allowing SYSTEM privilege escalation via MSI repair hijacking. Other flaws risk file deletion and DoS in ICS environments.
Hitachi Energy's Asset Suite, used in power gen, faces severe vulnerabilities including XSS, plaintext passwords, & RCE. Immediate action advised to secure systems.
CVEs 2025-26389 and 2025-26390 let attackers run code as root or gain admin access on Siemens OZW web servers. Patching is strongly advised.