Skip to content
OpenAdvisories

Source

CISA ICS & IT advisories

Source: https://www.cisa.gov/news-events/cybersecurity-advisories

All Critical High Medium Low With exploited CVEs

4,105 results · Feed

  • Medium max 4.3
    ICSA-14-105-01 1 CVE rev. 2

    Progea Movicon SCADA Information Disclosure Vulnerability

    Progea
    first Jan 16, 2014
  • High
    ICSA-13-219-01 2 CVEs rev. 2

    Schweitzer Engineering Laboratories Improper Input Validation

    SEL
    first May 10, 2013
  • High max 7.1
    ICSA-25-162-07 2 CVEs

    AVEVA PI Data Archive

    Successful exploitation of these vulnerabilities could shut down necessary subsystems and cause a denial-of-service condition.

    AVEVA
  • Medium max 6.5
    ICSA-25-162-08 1 CVE

    AVEVA PI Web API

    Successful exploitation of this vulnerability could allow an attacker to disable content security policy protections.

    AVEVA
  • Medium max 5.5
    ICSA-25-162-09 2 CVEs

    AVEVA PI Connector for CygNet

    Successful exploitation of these vulnerabilities could allow an attacker to persist arbitrary code in the administrative portal of the product or cause a denial-of-service condition.

    AVEVA
  • Critical max 9.8
    ICSA-25-162-10 4 CVEs 2 exploited

    PTZOptics and Other Pan-Tilt-Zoom Cameras

    Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.

    ValueHD, PTZOptics, multiCAM Systems, SMTAV
  • Critical max 9.8
    ICSA-24-030-01 4 CVEs rev. 2

    Emerson Rosemount GC370XA, GC700XA, GC1500XA

    Successful exploitation of these vulnerabilities could allow an unauthenticated attacker with network access to run arbitrary commands, access sensitive information, cause a denial-of-service condition, and bypass authentication to acquire admin capabilities.

    Emerson
    first Jan 30, 2024
  • High max 8.7
    ICSA-25-140-11 1 CVE rev. 2

    Assured Telematics Inc (ATI) Fleet Management System (Update A)

    Successful exploitation of this vulnerability could result in an attacker collecting sensitive file system information or obtain administrative credentials.

    Assured Telematics
    first May 20, 2025
  • High max 8.8
    ICSMA-25-160-01 1 CVE

    MicroDicom DICOM Viewer

    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer.

    MicroDicom
  • High max 8.6
    ICSA-25-160-01 2 CVEs

    SinoTrack GPS Receiver

    Successful exploitation of these vulnerabilities could allow an attacker to access device profiles for which they are not authorized through the common web management interface. Access to the device profile may allow an attacker to perform some remote functio…

    SinoTrack
  • High max 7.1
    ICSA-20-105-06 1 CVE rev. 5

    Siemens SIMOTICS, Desigo, APOGEE, and TALON

    SIMOTICS CONNECT 400, Desigo (Power PC-based), APOGEE MEC/MBC/PXC and TALON TC products are affected by a DHCP Client vulnerability as initially reported in SSA-434032 for the Mentor Nucleus Networking Module. Siemens has released updates for several affected…

    Siemens
    first Apr 14, 2020
  • Critical
    ICSA-21-103-11 14 CVEs rev. 2

    Siemens TIM 4R-IE Devices

    TIM 4R-IE devices contain multiple vulnerabilities in the integrated NTP component as listed below. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

    Siemens
    first Apr 13, 2021
  • High max 7.5
    ICSA-24-284-12 1 CVE rev. 3

    Siemens Sentron Powercenter 1000

    A vulnerability in SIRIUS 3RV2921-5M could allow an attacker to cause a denial of service condition. Siemens has released a new version for SIRIUS 3RV2921-5M and recommends to update to the latest version.

    Siemens
    first Oct 8, 2024
  • Critical max 8.7
    ICSA-24-338-02 18 CVEs 5 exploited rev. 6

    Siemens RUGGEDCOM APE1808

    Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where f…

    Siemens
    first Nov 22, 2024
  • Unscored max 6.5
    ICSA-24-347-10 1 CVE rev. 2

    Siemens SENTRON Powercenter 1000

    SENTRON Powercenter devices are not affected by a denial of service vulnerability that can be triggered during BLE (Bluetooth Low Energy) pairing. Note: Unlike stated in the initial version of this security advisory from 2024-12-10, detailed analysis has show…

    Siemens
    first Dec 10, 2024
  • High max 7.4
    ICSA-25-044-07 1 CVE rev. 4

    Siemens Teamcenter

    The SSO login service in Teamcenter contains an open redirect vulnerability that could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. Siemens has released new versions for the affected products and rec…

    Siemens
    first Feb 11, 2025
  • Medium max 5.3
    ICSA-25-105-01 1 CVE rev. 4

    Siemens Mendix Runtime

    Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has rele…

    Siemens
    first Apr 8, 2025
  • High max 7.8
    ICSA-25-162-01 1 CVE

    Siemens Tecnomatix Plant Simulation

    Siemens Tecnomatix Plant Simulation contains a out-of-bound read vulnerability that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the applica…

    Siemens
  • Medium max 4.3
    ICSA-25-162-03 1 CVE

    Siemens SCALANCE and RUGGEDCOM

    Several Industrial Communication Devices based on SINEC OS before V3.1 contain an incorrect authorization check vulnerability that could allow an attacker to perform actions that exceed the permissions of the "guest" role. Siemens has released new versions fo…

    Siemens
  • Critical max 9.9
    ICSA-25-162-06 1 CVE

    Siemens Energy Services

    Siemens Energy Services (previously known as Managed Applications and Services), sell solutions using Elspec G5 Digital Fault Recorder which contains default credentials with admin privileges. A client configuration with remote access could allow an attacker …

    Siemens
  • Critical
    ICSA-11-340-01 2 CVEs rev. 2

    ARC Informatique PcVue HMI/SCADA ActiveX Vulnerabilities

    ARC Informatique
    first Sep 8, 2011
  • Medium
    ICSA-11-335-01 1 CVE rev. 2

    7-Technologies Data Server Denial of Service

    7T
    first Sep 3, 2011
  • Critical
    ICSA-11-319-01 2 CVEs rev. 2

    InduSoft Web Studio Vulnerabilities

    InduSoft
    first Aug 18, 2011
  • Medium
    ICSA-11-314-01 1 CVE rev. 2

    Safenet Sentinel and 7-T Input Sanitization Vulnerability

    SafeNet
    first Aug 13, 2011
  • Critical
    ICSA-11-307-01 4 CVEs rev. 2

    Schneider Electric Vijeo Historian Web Server Multiple Vulnerabilities

    Schneider Electric
    first Aug 6, 2011
  • Critical
    ICSA-11-298-01A 1 CVE rev. 2

    Sielco Sistemi Winlog Buffer Overflow

    Sielco Sistemi
    first Jul 28, 2011
  • Critical
    ICSA-11-294-01 3 CVEs rev. 2

    Progea Movicon Power HMI Vulnerabilities

    Progea
    first Jul 24, 2011
  • Critical
    ICSA-11-280-01 4 CVEs rev. 2

    Cogent DataHub Vulnerabilities

    Cogent Real-Time Systems
    first Jul 10, 2011
  • Medium
    ICSA-11-279-04 1 CVE rev. 2

    Beckhoff TwinCAT Read Access Violation

    Beckhoff
    first Jul 9, 2011
  • Medium
    ICSA-11-279-03A 1 CVE rev. 2

    Unitronics UNIOPC Server Input Handling Vulnerability

    Unitronics
    first Jul 9, 2011
  • Medium
    ICSA-11-279-02 1 CVE rev. 2

    CitectSCADA and Mitsubishi MX4 SCADA Batch Server Buffer Overflow

    Schneider Electric
    first Jul 9, 2011
  • Critical
    ICSA-11-279-01 1 CVE rev. 2

    Advantech OPC Server Buffer Overflow

    Advantech
    first Jul 9, 2011
  • High
    ICSA-11-277-01 1 CVE rev. 2

    Schneider Electric UnitelWay Buffer Overflow

    Schneider Electric
    first Jul 7, 2011
  • High
    ICSA-14-189-01 1 CVE rev. 2

    Yokogawa Centum Buffer Overflow Vulnerability

    Yokogawa
    first Apr 10, 2014
  • High
    ICSA-14-175-01 2 CVEs rev. 2

    Honeywell FALCON XLWeb Controllers Vulnerabilities

    Honeywell
    first Mar 27, 2014
  • High max 7.1
    ICSA-14-154-01 2 CVEs rev. 2

    COPA-DATA Improper Input Validation

    COPA-DATA
    first Mar 6, 2014
  • High max 7.8
    ICSA-14-149-02 3 CVEs rev. 2

    Cogent DataHub Vulnerabilities

    Cogent Real-Time Systems
    first Mar 1, 2014
  • Medium max 4.3
    ICSA-14-149-01 2 CVEs rev. 2

    Triangle MicroWorks Uncontrolled Resource Consumption

    Triangle MicroWorks
    first Mar 1, 2014
  • Medium max 7.5
    ICSA-14-135-05 1 CVE 1 exploited rev. 2

    OpenSSL Vulnerability

    OpenSSL
    first Feb 15, 2014
  • Medium max 7.5
    ICSA-14-135-04 1 CVE 1 exploited rev. 2

    Unified Automation OPC SDK OpenSSL Vulnerability

    Unified Automation
    first Feb 15, 2014