CyberzSOC

CISA, FBI, NSA, NCSC, ASD/ACSC & NCSC Cyber Intelligence Feed
‹ March 2025 ›
72 publications — sorted newest first
Date Source Type Title Author
Mar 28, 2025 CISA Analysis Report CISA Releases Malware Analysis Report on RESURGE Malware Associated with Ivanti Connect Secure CISA released a Malware Analysis Report (MAR) on RESURGE, a novel malware variant exploiting CVE-2025-0282 in Ivanti Connect Secure appliances. RESURGE combines web shell, dropper, backdoor, bootkit, and rootkit capabilities and can persist across factory resets by modifying the appliance integrity checker. CISA
Mar 28, 2025 CISA Analysis Report MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE) This Malware Analysis Report (MAR-25993211) examines RESURGE malware targeting Ivanti Connect Secure via CVE-2025-0282. RESURGE establishes SSH tunnels for persistent access, harvests credentials, creates rogue administrative accounts, and modifies integrity checks to survive factory resets. CISA
Mar 27, 2025 CISA Alert CISA Releases One Industrial Control Systems Advisory These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-037-01 Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update A) This product is provided subject to this Notification and this Privacy & Use policy. CISA
Mar 27, 2025 CERT-EU Advisory 2025-013: Remote Code Execution Vulnerability in Splunk The vulnerability CVE-2025-20229, with a CVSS Score of 8.0, stems from missing authorisation checks in the file upload process to the $SPLUNK_HOME/var/run/splunk/apptemp directory. It allows low-privileged users to execute arbitrary code remotely by uploading malicious files to this specific directory on the server. CERT-EU
Mar 25, 2025 CISA Alert CISA Releases Four Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-084-02 Rockwell Automation Verve Asset Manager ICSA-25-084-03 Rockwell Automation 440G TLS-Z ICSA-25-084-04 Inaba Denki Sangyo CHOCO TEI WATCHER Mini This product is provided subject to this Notification and this Privacy & Use policy. CISA
Mar 25, 2025 CISA ICS Advisory ICSA-25-084-04: Inaba Denki Sangyo CHOCO TEI WATCHER mini Successful exploitation of these vulnerabilities could allow an attacker to obtain the product's login password, gain unauthorized access, tamper with product's data, and/or modify product settings. CISA
Mar 25, 2025 CISA ICS Advisory ICSA-25-084-03: Rockwell Automation 440G TLS-Z Successful exploitation of this vulnerability could allow an attacker to take over the device. CISA
Mar 25, 2025 CERT-EU Advisory 2025-012: Critical Vulnerabilities in Kubernetes Ingress-NGINX The vulnerabilities CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974 can be exploited to gain full cluster access, resulting in a complete compromise of the environment [1,2]. The vulnerabilities affect a widely used component in Kubernetes environments responsible for routing external traffic to internal services. CERT-EU
Mar 25, 2025 CISA ICS Advisory ICSA-25-084-02: Rockwell Automation Verve Asset Manager Successful exploitation of this vulnerability could allow an attacker with administrative access to run arbitrary commands in the context of the container running the service. CISA
Mar 25, 2025 CISA ICS Advisory ICSA-25-084-01: ABB RMC-100 An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. CISA
Mar 24, 2025 NSA Advisory Info Sheet: Selecting a Protective DNS Service (March 2025 Update) Security Infrastructure Cybersecurity Information Selecting a Protective DNS Service The Domain Name System (DNS) is central to the operation of modern networks, translating human-readable domain names into machine-usable Internet Protocol (IP) addresses. DNS makes navigating to a website, sending an email, or making a secure shell connection easier, and is a key component of the Internet's resilience. CISA, NCSC-UK, NSA
Mar 21, 2025 FBI Alert Individuals Target Tesla Vehicles and Dealerships Nationwide with Arson, Gunfire, and Vandalism The Federal Bureau of Investigation (FBI) is informing the public of recent nationwide incidents targeting Tesla electric vehicles (EV), dealerships, storage lots, and charging stations. Since January 2025, incidents targeting Tesla EVs have occurred in at least nine states. FBI
Mar 20, 2025 CISA ICS Advisory ICSA-25-079-04: SMA Sunny Portal Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code. CISA
Mar 20, 2025 CISA ICS Medical Advisory ICSMA-25-079-01: Santesoft Sante DICOM Viewer Pro Successful exploitation of this vulnerability could allow an attacker to cause memory corruption that would result in execution of arbitrary code. CISA
Mar 20, 2025 CISA ICS Advisory ICSA-25-079-02: Schneider Electric Enerlin’X IFE and eIFE Schneider Electric is aware of vulnerabilities in its Enerlin'X IFE and Enerlin'X eIFE products. The Enerlin'X IFE and eIFE products https://www.se.com/ww/en/product-range/62413-enerlinx-ife-eife-ifm/#products are used to enable Masterpact, PowerPact, and Compact circuit breakers to be connected to an Ethernet network. Failure to apply the provided below may risk Denial of Service, which could result in an attack which leads to unavailability of the IEC61850 services of the IFE/eIFE products and needs a manual reboot. CISA
Mar 20, 2025 NCSC Guidance Timelines for migration to post-quantum cryptography The national migration to post-quantum cryptography (PQC), mitigating the threat from future quantum computers, is a mass technology change that will The NCSC recognises the need both to offer guidance on some of the earlystage migration activities, and to set some indicative timelines that UK industry, government and regulators can follow. In this guidance, the NCSC sets out some key target dates for migration activities. NCSC-UK
Mar 20, 2025 CISA Vulnerability Advisory VA-25-079-01: CentralSquare eTRAKiT.Net SQL injection vulnerability eTRAKiT is a public online portal that provides the public with easily accessible information related to permits, projects, licenses, code compliance, land, and inspections. An SQL injection vulnerability in the CRM feature of eTRAKiT.net release 3.2.1.77 allows a remote, unauthenticated attacker to execute SQL queries and potentially arbitrary operating system commands as the Microsoft SQL Server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. CISA
Mar 20, 2025 CISA Alert CISA Releases Five Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-079-01 Schneider Electric EcoStruxure™ ICSA-25-079-02 Schneider Electric Enerlin’X IFE and eIFE ICSA-25-079-03 Siemens Simcenter Femap ICSA-25-079-04 SMA Sunny Portal ICSMA-25-079-01 Santesoft Sante DICOM Viewer Pro This product is provided subject to this Notification and this Privacy & Use policy. CISA
Mar 20, 2025 CISA ICS Advisory ICSA-25-079-03: Siemens Simcenter Femap Siemens Simcenter Femap is affected by memory corruption vulnerability that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions. CISA
Mar 20, 2025 CISA ICS Advisory ICSA-25-079-01: Schneider Electric EcoStruxure (Update A) Schneider Electric is aware of a vulnerability in its EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform products. The EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform products are engineering tools that facilitates and automates the design, maintenance, commissioning, and operation of Control projects for Modicon controllers and the associated Supervision projects for SCADA software regrouped in a system.. CISA
Mar 18, 2025 CISA ICS Advisory ICSA-25-077-04: Schneider Electric EcoStruxure Panel Server Schneider Electric is aware of a vulnerability in its EcoStruxure Panel Server product, all models. The EcoStruxure Panel Server https://www.se.com/us/en/product-range/40739468-ecostruxure-panel-server/#products is a modular gateway with enhanced cybersecurity that provides easy and fast connections to multiple concurrent edge control or cloud applications. Failure to apply the remediations provided below may risk disclosure of sensitive information, including the disclosure of credentials. CISA
Mar 18, 2025 CISA ICS Advisory ICSA-25-077-01: Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) Successful exploitation of this vulnerability could allow an attacker to bypass device authentication, potentially gain access to sensitive information, or execute arbitrary code. CISA
Mar 18, 2025 CISA ICS Advisory ICSA-25-077-02: Rockwell Automation Lifecycle Services with VMware Successful exploitation of these vulnerabilities could allow an attacker with local administrative privileges to execute code. CISA
Mar 18, 2025 CISA ICS Advisory ICSA-25-077-03: Schneider Electric EcoStruxure Power Automation System Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure Power Automation System User Interface product and EcoStruxure Microgrid Operation Large (EMO-L) solution. EcoStruxure Power Automation System User Interface https://www.se.com/ng/en/product-range/61456-ecostruxure-power-automation-system-user-interface/#overview (formerly known as EcoSUI) is a local SCADA/HMI, based on IEC 61850, that helps operators supervise, monitor, and control large and open electrical networks, with embedded cybersecurity. Formerly EcoStruxure Substation Operation User Interface. CISA
Mar 18, 2025 CISA ICS Advisory ICSA-25-077-05: Schneider Electric ASCO 5310/5350 Remote Annunciator Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products. The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone, industrial grade interface devices providing transfer switch status indication and transfer/retransfer control. CISA
Mar 18, 2025 CISA Alert CISA Releases Seven Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-077-01 Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) ICSA-25-077-02 Rockwell Automation Lifecycle Services with VMware ICSA-25-077-03 Schneider Electric EcoStruxure Power Automation System ICSA-25-077-04 Schneider Electric EcoStruxure Panel Server ICSA-25-077-05 Schneider Electric ASCO… CISA
Mar 18, 2025 CISA Alert Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154) The supply chain compromise allows for information disclosure of secrets including, but not limited to, valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys. This has been patched in v46.0.1. CISA
Mar 14, 2025 CERT-EU Advisory 2025-011: Critical Vulnerabilities in Gitlab It is recommended updating affected assets as soon as possible. ThecriticalvulnerabilitiesCVE-2025-25291andCVE-2025-25292affectthe ruby-saml library. CERT-EU
Mar 14, 2025 CERT-EU Advisory 2025-010: Critical Vulnerability in Cisco IOS XR Software On March 13, 2025, CISCO released an advisory regarding a critical vulnerability identified in It is recommended updating affected assets as soon as possible. The vulnerability CVE-2025-20138, with a CVSS score of 8.8, stems from insufficient input validation in specific CLI (Command Line Interface) commands within the 64-bit version of CiscoIOSXRSoftware. CERT-EU
Mar 14, 2025 CERT-EU Advisory 2025-009: Critical Vulnerabilities in Windows Remote Desktop Services Among the critical vulnerabilities are CVE-2025-24035 and CVE-2025-24045, both Remote Code Execution (RCE) vulnerabilities in Windows Remote Desktop Services (RDS). Each vulnerability has been assigned a CVSSv3 score of 8.1 and is rated as critical [1]. CERT-EU
Mar 14, 2025 CERT-EU Advisory 2025-008: High Vulnerabilities in Fortinet Products It is recommended updating as soon as possible. forgery vulnerability in FortiNDR that may allow a remote unauthenticated attacker to execute unauthorised actions via crafted HTTP GET requests [2]. that may allow a privileged attacker to execute unauthorised code or commands via specially crafted HTTP or HTTPS commands [3]. CERT-EU
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-07: Siemens SCALANCE M-800 and SC-600 Families SCALANCE M-800 and SC-600 families are affected by improper input validation in the OpenVPN authentication. Siemens has released new versions for the affected products and recommends to update to the latest versions. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-11: Siemens SIMATIC IPC Family, ITP1000, and Field PGs Multiple vulnerabilities has been identified in Siemens SIMATIC IPCs, SIMATIC Tablet PCs, and SIMATIC Field PGs that can allow an authenticated attacker to alter the secure boot and password configurations. Siemens has released new versions of BIOS for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. CISA
Mar 13, 2025 CISA Alert CISA Releases Thirteen Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-072-01 Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation ICSA-25-072-02 Siemens SINEMA Remote Connect Server ICSA-25-072-03 Siemens SIMATIC S7-1500 TM MFP ICSA-25-072-04 Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP ICSA-25-072-05 Siemens SINAMICS S200 ICSA-25-072-06 Siemens SCALANCE LPE9403 ICSA-2… CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-02: Siemens SINEMA Remote Connect Server SINEMA Remote Connect Server before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-05: Siemens SINAMICS S200 A specific range of produced SINAMICS S200 devices contains an unlocked bootloader vulnerability that could allow an attacker to download untrusted firmware that could damage or compromise the device. For delivered products listed below Siemens recommends countermeasures. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-10: Siemens SINEMA Remote Connect Client SINEMA Remote Connect Client before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-09: Siemens OPC UA The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-12: Sungrow iSolarCloud Android App, WiNet Firmware Successful exploitation of these vulnerabilities could result in attackers being able to access and could modify sensitive information. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-03: Siemens SIMATIC S7-1500 TM MFP Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. CISA
Mar 13, 2025 CISA ICS Medical Advisory ICSMA-25-072-01: Philips Intellispace Cardiovascular (ISCV) Successful exploitation of these vulnerabilities could allow an attacker to replay the session of the logged in ISCV user and gain access to patient records. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-08: Siemens Tecnomatix Plant Simulation Siemens Tecnomatix Plant Simulation do not properly limit the access of the simulation model to the filesystem. This could allow an unauthorized attacker to read or delete arbitrary files or the entire filesystem of the device. Siemens has released new versions for the affected products and recommends to update to the latest versions. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-06: Siemens SCALANCE LPE9403 SCALANCE LPE9403 is affected by multiple vulnerabilities that could allow an attacker to impact its confidentiality, integrity and availability. Siemens has released a new version for SCALANCE LPE9403 and recommends to update to the latest version. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-04: Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP SiPass integrated ACC (Advanced Central Controller) devices contain multiple vulnerabilities that could allow attackers to execute commands on the devices with root privileges and access sensitive data. Siemens has released new versions for the affected products and recommends to update to the latest versions. CISA
Mar 13, 2025 CISA ICS Advisory ICSA-25-072-01: Siemens Teamcenter Visualization and Tecnomatix Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released new versions for the affected products and recommends to update to the latest versions. CISA
Mar 12, 2025 FBI Alert #StopRansomware: Medusa Ransomware Finally, the registry is modified to allow Remote Desktop connections: fDenyTSConnections /t REG_DWORD /d 0 /f Mimikatz has also been observed in use for Local Security Authority Subsystem Service (LSASS) dumping [T1003.001] to harvest credentials [TA0006] and aid lateral movement. Medusa actors install and use Rclone to facilitate exfiltration of data to the Medusa C2 servers [T1567.002] used by actors and affiliates. CISA, FBI, MS-ISAC
Mar 12, 2025 JPCERT/CC Alert Microsoft Releases March 2025 Security Updates Microsoft has released March 2025 Security Updates to address the vulnerabilities in their products. Remote attackers leveraging these vulnerabilities may be able to execute arbitrary code. According to Microsoft, among the vulnerabilities, the following vulnerabilities have been confirmed to be exploited in the wild. JPCERT/CC
Mar 12, 2025 JPCERT/CC Alert Alert Regarding Vulnerabilities in Adobe Acrobat and Reader (APSB25-14) Vulnerabilities exists in Adobe Acrobat, a PDF file creation and conversion software, and Adobe Acrobat Reader, a PDF file viewing software. As a result, an attacker may execute arbitrary code by convincing a user to open contents leveraging the vulnerability. JPCERT/CC
Mar 12, 2025 CISA Advisory #StopRansomware: Medusa Ransomware CISA, FBI, and MS-ISAC warn that Medusa ransomware has targeted over 300 victims across critical infrastructure sectors since 2021 using a double-extortion model. Operators gain initial access via phishing and unpatched vulnerabilities, then encrypt systems and threaten to leak stolen data unless ransom is paid. CISA, FBI, MS-ISAC
Mar 12, 2025 CISA Alert CISA and Partners Release Cybersecurity Advisory on Medusa Ransomware This advisory provides tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity. Medusa is a ransomware-as-a-service variant used to conduct ransomware attacks; as of December 2024, over 300 victims from critical infrastructure sectors have been impacted. CISA, FBI, MS-ISAC
Mar 11, 2025 NCSC Guidance New DNS Check service now available in MyNCSC The data involved is a subset (currently limited to Dangling DNS vulnerabilities) of the vulnerability data returned by the basic monitoring undertaken within GDS’s Monitoring and sharing service . DNS Check will be available to organisations responsible for securing UK public sector domains. NCSC-UK
Mar 11, 2025 CISA Alert CISA Releases Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-070-01 Schneider Electric Uni-Telway Driver ICSA-25-070-02 Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool This product is provided subject to this Notification and this Privacy & Use policy. CISA
Mar 11, 2025 CISA ICS Advisory ICSA-25-070-01: Schneider Electric Uni-Telway Driver (Update D) Schneider Electric is aware of a vulnerability in its [Uni-Telway driver](https://www.se.com/us/en/product-range/573-unitelway/#overview) which is part of [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#overview), [EcoStruxure™ Process Expert](https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert), [EcoStruxure™ Process Expert for AVEVA System Platform](https://www.se.com/ww/en/product-range/55570689-ecostruxure-process-expert-for-aveva-system-platform/#overview) and [OPC Factory… CISA
Mar 11, 2025 CISA ICS Advisory ICSA-25-070-02: Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool (Update A) Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, gain control over the products, or impersonate the web applications. CISA
Mar 6, 2025 CERT-EU Advisory 2025-007: Critical Vulnerability in Kibana This flaw could allow an attacker to execute arbitrary code on the server. It is strongly recommended to update vulnerable Kibana instances. CERT-EU
Mar 6, 2025 FBI Alert Mail Scam Targeting Corporate Executives Claims Ties to Ransomware The Federal Bureau of Investigation (FBI) is issuing this announcement to inform businesses of a scam involving letters delivered in the mail from unidentified criminal actors to corporate executives, claiming to have come from a ransomware group. Stamped “Time Sensitive Read Immediately,” the letter claims the “BianLian Group” gained access into the organization’s network and stole thousands of sensitive data files. FBI
Mar 6, 2025 CISA Alert CISA Releases Three Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-065-01 Hitachi Energy PCU400 ICSA-25-065-02 Hitachi Energy Relion 670/650/SAM600-IO ICSA-25-037-02 Schneider Electric EcoStruxure (Update A) This product is provided subject to this Notification and this Privacy & Use policy. CISA
Mar 6, 2025 CISA Alert FBI Warns of Data Extortion Scam Targeting Corporate Executives The Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) has released an alert warning of a scam involving criminal actors masquerading as the “BianLian Group.” The cyber criminals target corporate executives by sending extortion letters threatening to release victims’ sensitive information unless payment is received. CISA, FBI
Mar 6, 2025 CISA ICS Advisory ICSA-25-065-01: Hitachi Energy PCU400 Hitachi Energy is aware of the multiple vulnerabilities related to various versions of OpenSSL library components used in PCU400 versions listed in this document below for IEC62351-3 secure for IEC104/DNP3 or PCULogger tool. These vulnerabilities if exploited, can cause confidentiality and availability impacts. Refer to the Recommended Immediate Actions for information about the available mitigation/remediation strategies. CISA
Mar 6, 2025 CISA ICS Advisory ICSA-25-065-02: Hitachi Energy Relion 670/650/SAM600-IO Hitachi Energy is aware of a vulnerability report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion® 670/650/SAM600-IO series versions listed below. Remediation is available for some versions. Recommended actions for each affected version are listed in the Recommended Immediate Actions Section. An attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. CISA
Mar 5, 2025 CERT-EU Advisory 2025-006: Critical Vulnerabilities in Mattermost If exploited, these vulnerabilities could allow an authenticated attacker to read any file on the server, or read data directly from the It is recommended to check for potential abuse, and to update vulnerable Mattermost instances. The vulnerability CVE-2025-25279, with a CVSS score of 9.9, arises due to a failure to validate board blocks during import processes. CERT-EU
Mar 5, 2025 FBI Alert Beijing Leveraging Freelance Hackers and Information Security Companies to Compromise Computer Networks Worldwide The FBI is releasing this public service announcement to highlight that the Chinese government is using formal and informal connections with freelance hackers and information security (InfoSec) companies to compromise computer networks worldwide. FBI
Mar 5, 2025 CERT-EU Advisory 2025-005: Several Vulnerabilities in VMware Products An attacker with access to a virtual machine could escape it to execute code on the host. Thevulnerability CVE-2025-22224,withaCVSSscoreof9.3,isaTOCTOU(Time-of-CheckTimeof-Use) vulnerability that leads to an out-of-bounds write. CERT-EU
Mar 4, 2025 CISA Alert CISA Releases Eight Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-063-01 Carrier Block Load ICSA-25-063-02 Keysight Ixia Vision Product Family ICSA-25-063-03 Hitachi Energy MACH PS700 ICSA-25-063-04 Hitachi Energy XMC20 ICSA-25-063-05 Hitachi Energy UNEM/ECST ICSA-25-063-06 Delta Electronics CNCSoft-G2 ICSA-25-063-08 Edimax IC-7100 IP Camera This product is provided subject to this N… CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-02: Keysight Ixia Vision Product Family (Update A) Successful exploitation of these vulnerabilities could allow an attacker to obtain or change data from the device, or remotely execute arbitrary code. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-08: Edimax IC-7100 IP Camera Successful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-07: GMOD Apollo Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, bypass authentication, upload malicious files, or disclose sensitive information. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-06: Delta Electronics CNCSoft-G2 Successful exploitation of this vulnerability could allow an attacker to execute code remotely. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-01: Carrier Block Load Successful exploitation of this vulnerability could allow a malicious actor to execute arbitrary code with escalated privileges . CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-03: Hitachi Energy MACH PS700 Hitachi Energy is aware of a vulnerability in third party component Intel Chipset Device Software, that affects MACH PS700 v2 product versions listed in this document. Authenticated malicious clients successfully exploiting this vulnerability could escalate the privilege to cause confidentiality, integrity and availability impacts. Please refer to the Recommended Immediate Actions for information about mitigation and remediation. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-05: Hitachi Energy UNEM/ECST Hitachi Energy is aware of a vulnerability that affects the UNEM/ECST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Actions” for information about the remediation. CISA
Mar 4, 2025 CISA ICS Advisory ICSA-25-063-04: Hitachi Energy XMC20 Hitachi Energy is aware of a vulnerability that affects the XMC20 versions listed below. Please refer to the “Recommended Immediate Actions” for information about the remediation. CISA