Skip to content
OpenAdvisories

Source

CISA ICS & IT advisories

Source: https://www.cisa.gov/news-events/cybersecurity-advisories

All Critical High Medium Low With exploited CVEs

4,105 results · Feed

  • Medium
    ICSA-16-103-02 1 CVE rev. 2

    Siemens SCALANCE S613 Denial-of-Service Vulnerability

    Siemens
    first Jan 14, 2016
  • High
    ICSA-16-103-01C 1 CVE rev. 2

    Siemens Industrial Products glibc Library Vulnerability (Update C)

    Siemens
    first Jan 14, 2016
  • Critical
    ICSA-16-096-01 4 CVEs rev. 2

    Pro-face GP-Pro EX HMI Vulnerabilities

    Pro-face
    first Jan 7, 2016
  • Critical
    ICSA-16-091-01 1 CVE rev. 2

    ICONICS WebHMI Directory Traversal Vulnerability

    ICONICS
    first Jan 2, 2016
  • High
    ICSA-16-084-01 1 CVE rev. 2

    Cogent DataHub Elevation of Privilege Vulnerability

    Cogent Real-Time Systems
    first Dec 26, 2016
  • Low
    ICSA-16-082-01A 1 CVE rev. 2

    Siemens APOGEE Insight Incorrect File Permissions Vulnerability (Update A)

    Siemens
    first Dec 24, 2016
  • High
    ICSA-16-077-01A 1 CVE rev. 2

    ABB Panel Builder 800 DLL Hijacking Vulnerability (Update A)

    ABB
    first Dec 19, 2016
  • Medium
    ICSA-16-075-01 1 CVE rev. 2

    Siemens SIMATIC S7-1200 CPU Protection Mechanism Failure

    Siemens
    first Dec 17, 2016
  • High
    ICSA-16-070-02A 1 CVE rev. 2

    Honeywell Uniformance PHD Denial Of Service (Update A)

    Honeywell
    first Dec 12, 2016
  • Medium
    ICSA-16-070-01 1 CVE rev. 2

    Schneider Electric Telvent RTU Improper Ethernet Frame Padding Vulnerability

    Schneider Electric
    first Dec 12, 2016
  • Medium
    ICSA-16-063-01 2 CVEs rev. 2

    Moxa ioLogik E2200 Series Weak Authentication Practices

    Moxa
    first Dec 5, 2016
  • High
    ICSA-16-061-03 2 CVEs rev. 2

    Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerabilities

    Eaton
    first Dec 3, 2016
  • Medium max 6.1
    ICSA-16-061-02 1 CVE rev. 2

    Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting Vulnerability (Update A)

    Rockwell Automation
    first Dec 3, 2016
  • High
    ICSA-16-061-01 1 CVE rev. 2

    Schneider Electric Building Operation Automation Server Vulnerability

    Schneider Electric
    first Dec 3, 2016
  • Medium
    ICSA-16-056-01 1 CVE rev. 2

    Rockwell Automation Integrated Architecture Builder Access Violation Memory Error

    Rockwell Automation
    first Nov 28, 2016
  • Critical
    ICSA-16-049-02A 2 CVEs rev. 2

    AMX Multiple Products Credential Management Vulnerabilities (Update A)

    Harman
    first Nov 21, 2016
  • Critical
    ICSA-16-049-01 1 CVE rev. 2

    B+B SmartWorx VESP211 Authentication Bypass Vulnerability

    B+B SmartWorx
    first Nov 21, 2016
  • Critical
    ICSA-16-042-01A 5 CVEs rev. 2

    Moxa EDR-G903 Secure Router Vulnerabilities (Update A)

    Moxa
    first Nov 14, 2016
  • High
    ICSA-16-040-02 2 CVEs rev. 2

    Siemens SIMATIC S7-1500 CPU Vulnerabilities

    Siemens
    first Nov 12, 2016
  • High
    ICSA-16-040-01 4 CVEs rev. 2

    Tollgrade SmartGrid Sensor Management System Software Vulnerabilities

    Tollgrade Communications
    first Nov 12, 2016
  • High
    ICSA-16-033-02 2 CVEs rev. 2

    GE SNMP/Web Interface Vulnerabilities

    GE
    first Nov 5, 2016
  • Critical
    ICSA-16-033-01 3 CVEs rev. 2

    Sauter moduWeb Vision Vulnerabilities

    Sauter
    first Nov 5, 2016
  • Critical
    ICSA-16-028-01A 1 CVE rev. 2

    Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A)

    Westermo
    first Oct 31, 2016
  • High max 7.5
    ICSA-21-049-02 2 CVEs rev. 9

    Mitsubishi Electric FA Engineering Software Products (Update H)

    Successful exploitation of these vulnerabilities may cause a denial-of-service condition.

    Mitsubishi Electric
    first Feb 18, 2021
  • Critical max 9.8
    ICSA-25-155-01 5 CVEs

    CyberData 011209 SIP Emergency Intercom

    Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial-of-service condition, or achieve code execution.

    CyberData
  • Critical max 9.8
    ICSA-25-153-01 1 CVE

    Schneider Electric Wiser Home Automation

    Successful exploitation of this vulnerability could allow an attacker to inject code or bypass authentication.

    Schneider Electric
  • Critical max 9.1
    ICSA-25-153-03 1 CVE

    Mitsubishi Electric MELSEC iQ-F Series

    Successful exploitation of this vulnerability could allow an attacker to read confidential information, cause a denial-of-service condition, or stop operations by sending specially crafted packets.

    Mitsubishi Electric
  • High max 7.8
    ICSMA-25-148-01 1 CVE

    Santesoft Sante DICOM Viewer Pro

    Successful exploitation of this vulnerability could allow an attacker to disclose information or execute arbitrary code.

    Santesoft
  • Medium max 5.3
    VA-25-147-01 1 CVE 1 exploited

    Craft CMS stores user-provided content session files

    Craft CMS stores user-provided content in session files. A remote, unauthenticated attacker can introduce arbitrary content, including PHP code, into session files with known names and locations. If an attacker can access these files, possibly through another…

    Craft
  • High max 7.3
    VA-25-148-01 1 CVE

    ZKTeco BioTime multiple vulnerabilities

    ZKTeco BioTime is a web-based time and attendance management software. A default password vulnerability was found that allows an attacker to log in to any user account that does not change their password. Attackers utilizing this obtain user credentials and c…

    ZKTeco
  • High max 8.1
    ICSA-21-336-05 1 CVE rev. 3

    Hitachi Energy Relion 670/650/SAM600-IO

    Hitachi Energy is aware of a report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion 670/650/SAM600-IO series versions listed below. Recommended action for each affected version is listed in the Recommended Immediate Actions …

    Hitachi Energy
    first Nov 4, 2021
  • Critical max 7.3
    ICSA-25-155-02 2 CVEs rev. 2

    Hitachi Energy Relion 670 650 series and SAM600-IO Product

    Hitachi Energy is aware of two critical memory allocation vulnerabilities (called BadAlloc [1] vulnerabilities) in the WindRiver VxWorks Operating Systems [2][3] that are used in our product versions listed in this advisory. An attacker that exploits these vu…

    Hitachi Energy
    first Dec 16, 2021
  • High max 6.3
    ICSA-25-146-01 1 CVE

    Johnson Controls iSTAR Configuration Utility (ICU) tool

    Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. This utility is only used to configure products that are no longer manufactured or supported. ICU is not used to configure the iSTAR Ultra and th…

    Johnson Controls
  • Medium max 6.8
    ICSA-25-142-01 1 CVE

    Lantronix Device Installer

    Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software.

    LANTRONIX
  • Critical max 9.8
    ICSA-25-142-02 1 CVE

    Rockwell Automation FactoryTalk Historian ThingWorx

    Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files.

    Rockwell Automation
  • Medium max 6.8
    ICSA-25-140-01 1 CVE

    ABUP IoT Cloud Platform

    Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized.

    ABUP
  • High max 7.8
    ICSA-25-140-02 5 CVEs

    National Instruments Circuit Design Suite

    Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code.

    National Instruments
  • Critical max 10.0
    ICSA-25-140-09 1 CVE

    AutomationDirect MB-Gateway

    Successful exploitation of this vulnerability could allow an attacker to make configuration changes, disrupt operations, or achieve arbitrary code execution.

    Automation Direct
  • Critical max 9.8
    ICSA-25-140-10 2 CVEs

    Vertiv Liebert RDU101 and UNITY

    Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or achieve remote code execution

    Vertiv
  • High max 7.8
    VA-25-119-01 2 CVEs rev. 2

    MSP360 Backup insecure filesystem permissions

    MSP360 Backup is a data backup and recovery solution. Insecure file system permission vulnerabilities in both the Windows and Linux versions allow a lower privileged user to execute commands the privileges of other users, including administrative users. An at…

    MSP360
    first Apr 29, 2025