| Date | Source | Type | Title | Author |
|---|---|---|---|---|
| May 29, 2025 | CISA | Alert | CISA Releases Five Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-148-02 Siemens SiPass Integrated ICSA-25-148-03 Consilium Safety CS5000 Fire Panel ICSA-25-148-04 Instantel Micromate ICSMA-25-148-01 Santesoft Sante DICOM Viewer Pro This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 29, 2025 | FBI | Alert | Infrastructure Used to Manage Domains Related to Cryptocurrency Investment Fraud Scams Between October 2023 and April 2025 29 May 2025 The following information is being provided by the FBI, with no guarantees or warranties, for potential use at the sole discretion of recipients to protect against cyber threats. This data is provided in order to help cyber security professionals and system administrators to guard against the persistent malicious actions of cyber actors. This FLASH was coordinated with DHS/CISA. WE NEED YOUR HELP! | FBI |
| May 28, 2025 | CISA | ICS Advisory | ICSA-25-148-03: Consilium Safety CS5000 Fire Panel (Update A) Successful exploitation of these vulnerabilities could allow an attacker to gain high-level access to and remotely operate the device, potentially putting it into a non-functional state. | CISA |
| May 28, 2025 | CISA | ICS Advisory | ICSA-25-148-01: Siemens SiPass SiPass integrated ACC (Advanced Central Controller) devices do not properly check the integrity of firmware updates. This could allow an attacker to upload a maliciously modified firmware onto the device. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| May 28, 2025 | CISA | ICS Advisory | ICSA-25-148-04: Instantel Micromate (Update A) Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the device's configuration port and execute commands. | CISA |
| May 28, 2025 | CISA | ICS Medical Advisory | ICSMA-25-148-01: Santesoft Sante DICOM Viewer Pro Successful exploitation of this vulnerability could allow an attacker to disclose information or execute arbitrary code. | CISA |
| May 28, 2025 | CISA | Vulnerability Advisory | VA-25-148-01: ZKTeco BioTime multiple vulnerabilities ZKTeco BioTime is a web-based time and attendance management software. A default password vulnerability was found that allows an attacker to log in to any user account that does not change their password. Attackers utilizing this obtain user credentials and can possibly perform actions as an administrative user if able to successfully log in as one. Users should change their passwords (located under the Attendance Settings tab as "Self-Password"). | CISA |
| May 28, 2025 | CISA | ICS Advisory | ICSA-25-148-02: Siemens SiPass Integrated SiPass integrated versions before V2.95.3.18 contain an out of bounds read vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition. Siemens has released a new version for SiPass integrated and recommends to update to the latest version. | CISA |
| May 27, 2025 | CISA | Vulnerability Advisory | VA-25-147-01: Craft CMS stores user-provided content session files Craft CMS stores user-provided content in session files. A remote, unauthenticated attacker can introduce arbitrary content, including PHP code, into session files with known names and locations. If an attacker can access these files, possibly through another vulnerability such as CVE-2024-58136 (or CVE-2025-32432). For context, Yii fixed CVE-2024-4990 then later re-introduced it as CVE-2024-58136. Craft CMS assigned CVE-2025-32432 to the Craft CMS inheritance of CVE-2024-58136. | CISA |
| May 27, 2025 | NSA | Advisory | Priority Logs For SIEM Ingestion Practitioner Guidance The authors would like to acknowledge the industry partners that contributed to this publication. In this publication, the authoring agencies provide cyber security practitioners with detailed recommendations on the logs that should be prioritised for ingestion by a Security Information and Event Management (SIEM) platform. | NSA |
| May 27, 2025 | NSA | Advisory | Implementing SIEM and SOAR Platforms: Practitioners Guidance 4. Best practice principles for implementing a SIEM and/or SOAR 12 This publication provides high-level guidance for cyber security practitioners on Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. | ASD/ACSC, NSA |
| May 27, 2025 | CISA | Alert | New Guidance for SIEM and SOAR Implementation Today, CISA, in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and other international and U.S. partners, released new guidance for organizations seeking to procure Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. | CISA |
| May 27, 2025 | CISA | Alert | CISA Releases One Industrial Control Systems Advisory These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-146-01 Johnson Controls iSTAR Configuration Utility (ICU) Tool This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 26, 2025 | CISA | ICS Advisory | ICSA-25-146-01: Johnson Controls iSTAR Configuration Utility (ICU) tool Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. This utility is only used to configure products that are no longer manufactured or supported. ICU is not used to configure the iSTAR Ultra and the current iSTAR G2 series of controllers. Furthermore, this vulnerability only impacts ICU and the Windows PC it is running on. This vulnerability does not impact iSTARs, including the legacy iSTARs. | CISA |
| May 23, 2025 | FBI | Alert | Silent Ransom Group Targeting Law Firms 23 May 2025 The following information is being provided by the FBI, with no guarantees or warranties, for potential use at the sole discretion of recipients to protect against cyber threats. This data is provided to help cyber security professionals and system administrators guard against the persistent malicious actions PIN Number of cyber actors. This PIN was coordinated with DHS/CISA. | FBI |
| May 22, 2025 | CISA | Alert | Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic) There is no singular, authoritative, recognized way to architect an Identity, Credential, and Access Management (ICAM) capability across an enterprise, which results in many U.S. government agencies addressing this critical capability from different directions with different priorities. | CISA |
| May 22, 2025 | CISA | Alert | CISA Releases Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-142-01 Lantronix Device Installer ICSA-25-142-02 Rockwell Automation FactoryTalk Historian ThingWorx This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 22, 2025 | CISA | Alert | New Best Practices Guide for Securing AI Data Released This information sheet highlights the critical role of data security in ensuring the accuracy, integrity, and trustworthiness of AI outcomes. It outlines key risks that may arise from data security and integrity issues across all phases of the AI lifecycle, from development and testing to deployment and operation. | CISA |
| May 22, 2025 | CISA | ICS Advisory | ICSA-25-142-02: Rockwell Automation FactoryTalk Historian ThingWorx Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files. | CISA |
| May 22, 2025 | CISA | ICS Advisory | ICSA-25-142-01: Lantronix Device Installer Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software. | CISA |
| May 22, 2025 | FBI | Alert | AI Data Security Joint Cybersecurity Information Best Practices for Securing Data Used to Train & Operate AI Systems This Cybersecurity Information Sheet (CSI) provides essential guidance on securing data used in artificial intelligence (AI) and machine learning (ML) systems. | ASD/ACSC, CISA, FBI, NCSC-NZ, NCSC-UK, NSA |
| May 22, 2025 | NSA | Guidance | CSI: AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems Joint Cybersecurity Information This Cybersecurity Information Sheet (CSI) provides essential guidance on securing data used in artificial intelligence (AI) and machine learning (ML) systems. It also highlights the importance of data security in ensuring the accuracy and integrity of AI outcomes and outlines potential risks arising from data integrity issues in various stages of AI development and deployment. | ASD/ACSC, CISA, FBI, NCSC-NZ, NCSC-UK, NSA |
| May 21, 2025 | NSA | Alert | Russian GRU Targeting Western Logistics Entities and Technology Companies This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under… | ANSSI, ASD/ACSC, BSI, CCCS, DC3, DDIS, EFIS, FBI, MIVD, NCSC-UK, NSA, NUKIB, SKW, USCC |
| May 21, 2025 | FBI | Alert | Cybercriminal Services Target End-of-Life Routers to Launch Attacks and Hide Their Activities | FBI |
| May 21, 2025 | FBI | Alert | Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations LummaC2 malware is able to infiltrate victim computer networks and exfiltrate sensitive information, threatening vulnerable individuals’ and organizations’ computer networks across multiple U.S. critical infrastructure sectors. According to FBI information and trusted third-party reporting, this activity has been observed as recently as May 2025. | CISA, FBI |
| May 21, 2025 | NSA | Advisory | Russian GRU Targeting Western Logistics Entities and Technology Companies Executive Summary This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. | ASD/ACSC, CCCS, CISA, FBI, NCSC-UK, NSA, USCC |
| May 21, 2025 | CISA | Advisory | Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations CISA and partners warn that threat actors are deploying LummaC2 infostealer malware to exfiltrate credentials, financial information, and sensitive data from organizations. LummaC2 is typically distributed through phishing, malvertising, and trojanized software downloads. | CISA, FBI |
| May 21, 2025 | CISA | Alert | Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies and international partners released a joint Cybersecurity Advisory, Russian GRU Targeting Western Logistics Entities and Technology Companies . This advisory details a Russian state-sponsored cyber espionage-oriented campaign targeting technology companies and logistics entities, including those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. | CISA |
| May 21, 2025 | CISA | Alert | Threat Actors Target U.S. Critical Infrastructure with LummaC2 Malware Critical Infrastructure Sectors . This advisory details the tactics, techniques, and procedures, and indicators of compromise (IOCs) linked to threat actors deploying LummaC2 malware. This malware poses a serious threat, capable of infiltrating networks and exfiltrating sensitive information, to vulnerable individuals’ and organizations’ computer networks across U.S. critical infrastructure sectors. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-02: National Instruments Circuit Design Suite Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-10: Vertiv Liebert RDU101 and UNITY Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or achieve remote code execution | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-01: ABUP IoT Cloud Platform Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-05: Siemens Siveillance Video The installer of Siveillance Video V2024 R1 resets the system configuration password when updating from older versions of Siveillance Video. This could inadvertently remove the password protection from system configuration files, also affecting backup data sets that were created after the update to V2024 R1. Siemens recommends to change the system configuration password settings for systems that were updated from any older version to V2024 R1. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-06: Schneider Electric PrismaSeT Active - Wireless Panel Server Schneider Electric is aware of a vulnerability disclosed in the Silicon Labs Gecko Bootloader used in the PrismaSet Active - Wireless Panel Server. The PrismaSeT Active - Wireless Panel Server https://www.se.com/ww/en/product-range/39982243-prismaset-p-active/#products product is the latest generation of low-voltage switchboards, natively connected to the cloud. Failure to apply the mitigations provided below may risk unauthorized code execution, which could result in the unavailability of the Prisma SeT Active Wireless Panel Server for Voltage loss monitoring. | CISA |
| May 20, 2025 | NCSC | Guidance | Decommissioning assets How to retire digital assets (such as data, software, or hardware) from operation. This guidance describes why it’s important for organisations to decommission digital assets, and how to do so securely. For advice dealing specifically with decommissioning hardware, please refer to our guidance on discontinuing obsolete products or network devices. | NCSC-UK |
| May 20, 2025 | CISA | Alert | CISA Releases Thirteen Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-140-01 ABUP IoT Cloud Platform ICSA-25-140-02 National Instruments Circuit Design Suite ICSA-25-140-03 Danfoss AK-SM 8xxA Series ICSA-25-140-04 Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products ICSA-25-140-05 Siemens Siveillance Video ICSA-25-140-06 Schneider Electric PrismaSeT Active - Wir… | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-11: Assured Telematics Inc (ATI) Fleet Management System (Update A) Successful exploitation of this vulnerability could result in an attacker collecting sensitive file system information or obtain administrative credentials. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-03: Danfoss AK-SM 8xxA Series (Update A) Successful exploitation of these vulnerabilities could enable a remote attacker to bypass authentication and remotely execute arbitrary code. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-07: Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A) Schneider Electric is aware of a vulnerability disclosed on the Erlang/OTP's SSH Server component used Schneider Electric Galaxy VS, VL, and VXL.Many vendors, including Schneider Electric, embed the Erlang/OTP's SSH Server in their offers.The Galaxy VS, Galaxy VL, Galaxy VXL products are 3-phase UPS for data centers and other business critical applications.Failure to apply the mitigation provided below may risk unauthenticated remote code execution (RCE), which could impact the monitoring capabilities of the UPS and potential UPS operation. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-08: Schneider Electric Modicon Controllers (Update B) Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products. The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications. Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-04: Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update F) Successful exploitation of this vulnerability could allow a local attacker to make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file, enabling the attacker to destroy the file on a PC with affected products installed and thereby cause a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC. | CISA |
| May 20, 2025 | CISA | ICS Advisory | ICSA-25-140-09: AutomationDirect MB-Gateway Successful exploitation of this vulnerability could allow an attacker to make configuration changes, disrupt operations, or achieve arbitrary code execution. | CISA |
| May 16, 2025 | CISA | Vulnerability Advisory | VA-25-136-01: IBM Security Guardium stored cross-site scripting IBM Security Guardium 11.5 before patch 11.0p565 is vulnerable to stored cross-site scripting (XSS). An attacker with administrative privileges could store arbitrary content or script in the administrative web interface that would be rendered or executed by users visiting modified parts of the web interface. The attacker may be able or obtain session tokens which could be used to log in as a different user. | CISA |
| May 16, 2025 | CERT-EU | Advisory | 2025-018: Zero-Day Vulnerabilities in Ivanti EPMM An attacker could chain those vulnerabilities to achieve unauthenticated remote code execution on the vulnerable device. These vulnerabilities have been exploited in a [New] The analysis conducted by WatchTowr [3] provides significantly more information than the advisory issued by Ivanti in two key aspects: that they are related to third-party libraries. | CERT-EU |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-17: Siemens RUGGEDCOM ROX II The web interface of RUGGEDCOM ROX II devices contain multiple Client-Side Enforcement of Server-Side Security vulnerabilities that could allow an attacker with a legitimate, highly privileged account on the web interface to get privileged code execution in the underlying OS of the affected products. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-16: Siemens MS/TP Point Pickup Module MS/TP Point Pickup Module devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's normal operation. Siemens recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-15: Siemens Mendix OIDC SSO The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | Alert | CISA Releases Twenty-Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-135-01 Siemens RUGGEDCOM APE1808 Devices ICSA-25-135-02 Siemens INTRALOG WMS ICSA-25-135-03 Siemens BACnet ATEC Devices ICSA-25-135-05 Siemens SIPROTEC and SICAM ICSA-25-135-06 Siemens Teamcenter Visualization ICSA-25-135-07 Siemens IPC RS-828A ICSA-25-135-08 Siemens VersiCharge AC Series EV Chargers ICSA-25-135-09 Sie… | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-09: Siemens User Management Component (UMC) Siemens User Management Component (UMC) is affected by three vulnerabilities which could allow an unauthenticated remote attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-05: Siemens SIPROTEC and SICAM This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-01: Siemens RUGGEDCOM APE1808 Devices Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-07: Siemens SIMATIC IPC RS-828A SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller (BMC) that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability of the BMC and thus the entire system. Siemens has released a new version for SIMATIC IPC RS-828A - BMC firmware and recommends to update to the latest version. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-02: Siemens INTRALOG WMS INTRALOG WMS before V5 is affected by multiple vulnerabilities in the Microsoft .NET implementation as described below. Siemens has released a new version for INTRALOG WMS and recommends to update to the latest version. Please approach your INTRALOG WMS contact to resolve the reported vulnerabilities for your solution. When contacting your Siemens representative, kindly reference the Siemens Security Advisory ID (SSA-901508). | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-19: ECOVACS DEEBOT Vacuum and Base Station (Update A) Successful exploitation of these vulnerabilities could allow an attacker to send malicious updates to the devices or execute code. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-03: Siemens BACnet ATEC Devices BACnet ATEC devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's normal operation. Siemens recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-18: Siemens SCALANCE LPE9403 SCALANCE LPE9403 is affected by multiple vulnerabilities which lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SCALANCE LPE9403 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-04: Siemens Desigo Desigo CC deployments that use Installed Client are impacted by an information disclosure vulnerability which could result in information leak from the Desigo CC server. The other Desigo CC client options, Windows App Client and Flex Client, are not affected by this vulnerability. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-06: Siemens Teamcenter Visualization Siemens Teamcenter Visualization contains a out-of-bound read vulnerability that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-08: Siemens VersiCharge AC Series EV Chargers VersiCharge AC Series EV Chargers contain two vulnerabilities that could allow an attacker to gain control of the chargers through default Modbus port or execute arbitrary code by manipulating the M0 firmware. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | FBI | Alert | Senior U.S. Officials Impersonated in Malicious Messaging Campaign Since April 2025, malicious actors have impersonated senior U.S. officials to target individuals, many of whom are current or former senior U.S. federal or state government officials and their contacts. If you receive a message claiming to be from a senior U.S. official, do not assume it is authentic. | CISA, FBI |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-10: Siemens OZW Web Servers OZW672 and OZW772 Web Server versions contain vulnerabilities that could allow an attacker to execute arbitrary code on the device with root privileges (in versions before V8.0) or to authenticate as Administrator user (in versions before V6.0). Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-11: Siemens Polarion Polarion before V2410 contains multiple vulnerabilities that could allow attackers to extract data, conduct cross-site scripting attacks or find out valid usernames. Siemens strongly recommends to update Polarion to V2410 or later versions, not only to fix the documented vulnerabilities, but also to benefit from all the other improvements and fixes. For Polarion V2404 patch releases can be applied. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-12: Siemens SIMATIC PCS Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-20: Schneider Electric EcoStruxure Power Build Rapsody Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-13: Siemens SIRIUS SIRIUS 3SK2 Safety Relays and 3RK3 Modular Safety Systems only provide weak password obfuscation. An attacker with access to the PROFINET or serial interface of the device could eavesdrop or read the stored password from the device and de-obfuscate it. The safety passwords work as protection against unauthorized operation (i.e., protection against inadvertent operating errors) but not as protection against malicious access attempts. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 15, 2025 | CISA | ICS Advisory | ICSA-25-135-14: Siemens APOGEE PXC and TALON TC Series APOGEE PXC and TALON TC Series (BACnet) Devices devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation. Siemens recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| May 14, 2025 | JPCERT/CC | Alert | Microsoft Releases May 2025 Security Updates Microsoft has released May 2025 Security Updates to address the vulnerabilities in their products. Remote attackers leveraging these vulnerabilities may be able to execute arbitrary code. According to Microsoft, among the vulnerabilities, the following vulnerability have been confirmed to be exploited in the wild. | JPCERT/CC |
| May 13, 2025 | CISA | ICS Advisory | ICSA-25-133-02: Hitachi Energy Relion 670/650/SAM600-IO Series (Update C) Hitachi Energy is aware of the vulnerability CVE-2023-4518 that affects the Relion 670/650/SAM600-IO series that are listed below. An attacker successfully exploiting this vulnerability could cause operational disruptions of the devices. | CISA |
| May 13, 2025 | FBI | Alert | Impersonation Scheme Targeting Middle Eastern Students in the United States The FBI is warning the public about a fraud scheme targeting foreign individuals lawfully residing in the United States on valid student visas. Criminal scammers impersonate US and foreign government officials claiming there is an issue with the student's immigration status and exploit this for financial gain. Thus far, we are aware scammers have targeted students from the United Arab Emirates (UAE), Saudi Arabia, Qatar, and Jordan. | FBI |
| May 13, 2025 | CERT-EU | Advisory | 2025-019: Critical Vulnerabilities in Fortinet Products The vulnerability CVE-2025-32756 [1], with a CVSS score of 9.6, is a stack-based overflow vulnerability in FortiFone, FortiVoice, FortiNDR, and FortiMail that could allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. | CERT-EU |
| May 13, 2025 | CISA | ICS Advisory | ICSA-25-133-03: Hitachi Energy MACH GWS products Hitachi Energy is aware of the multiple vulnerabilities that affect the MACH GWS product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. | CISA |
| May 13, 2025 | CISA | ICS Advisory | ICSA-25-133-01: Hitachi Energy Service Suite Hitachi Energy is aware of the multiple vulnerabilities related to open-source Apache Tomcat components that affect the Service Suite product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. | CISA |
| May 13, 2025 | CISA | ICS Advisory | ICSA-25-133-04: ABB Automation Builder (Update A) ABB is aware of vulnerabilities in the product versions listed as affected in the following section. An attacker who successfully exploited this vulnerability could overrule the Automation Builder’s user management. Workarounds to close the vulnerabilities are available. | CISA |
| May 12, 2025 | CISA | Alert | Update to How CISA Shares Cyber-Related Alerts and Notifications Starting May 12 , CISA is changing how we announce cybersecurity updates and the release of new guidance. These announcements will only be shared through CISA social media platforms and email and will no longer be listed on our Cybersecurity Alerts & Advisories webpage . We greatly appreciate stakeholder feedback which played a part in this change and thank you for staying connected with CISA. | CISA |
| May 8, 2025 | CISA | ICS Advisory | ICSA-25-128-03: Mitsubishi Electric Multiple FA Products (Update D) Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition, a timeout error, or a communication delay by sending a specially crafted UDP packet to the product. | CISA |
| May 8, 2025 | CISA | ICS Medical Advisory | ICSMA-25-128-01: Pixmeo OsiriX MD Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption, resulting in a denial-of-service condition or to steal credentials. | CISA |
| May 8, 2025 | CISA | ICS Advisory | ICSA-25-128-01: Horner Automation Cscape Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code. | CISA |
| May 8, 2025 | CISA | Alert | CISA Releases Five Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-128-01 Horner Automation Cscape ICSA-25-128-02 Hitachi Energy RTU500 series ICSA-25-128-03 Mitsubishi Electric CC-Link IE TSN ICSA-25-093-01 Hitachi Energy RTU500 Series (Update A) ICSMA-25-128-01 Pixmeo OsiriX MD This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 8, 2025 | CISA | ICS Advisory | ICSA-25-128-02: Hitachi Energy RTU500 series Hitachi Energy is aware of the vulnerabilities CVE-2023-5767, CVE-2023-5768 and CVE-2023-5769 in the Web server and HCI IEC 60870-5-104 component, that affects the RTU500 versions that are listed below. An at- tacker successfully exploiting these vulnerabilities could perform cross-site scripting on web server or denial of service on HCI IEC 60870-5-104. Please refer to the Recommended Immediate Actions for information about the available mitigation/remediation strategies. | CISA |
| May 7, 2025 | FBI | Alert | Cybercriminal Proxy Services Exploiting End-of-Life Routers When a hardware device is end of life, the manufacturer no longer sells the product and is not actively supporting the hardware, which also means they are no longer releasing software updates or security patches for the device. Routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer and could be compromised by cyber actors exploiting known vulnerabilities. | FBI |
| May 7, 2025 | NCSC | Guidance | Software Security Code of Practice - Assurance Principles and Claims (APCs) Helps vendors measure how well they meet the Software Security Code of Practice, and suggests remedial actions should they fall short. This document allows technical staff to self-assess their own software practices against the Software Security Code of Practice, a set of outcomes that – if met – means the vendor can claim that their software has achieved a baseline of software security and resilience. | NCSC-UK |
| May 7, 2025 | NCSC | Analysis Report | Impact of AI on cyber threat from now to 2027 An NCSC assessment highlighting the impacts on cyber threat from AI developments NCSC Assessment (NCSC-A) is the authoritative voice on the cyber threat to the UK. We combine source information – classified intelligence, industry knowledge, academic material and open source – to provide independent key judgements that inform policy decision making and improve UK cyber security. | NCSC-UK |
| May 6, 2025 | CISA | Alert | CISA Releases Three Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-126-01 Optigo Networks ONS NC600 ICSA-25-126-02 Milesight UG65-868M-EA ICSA-25-126-03 BrightSign Players This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 6, 2025 | CISA | Alert | Unsophisticated Cyber Actor(s) Targeting Operational Technology critical Infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems. Although these activities often include basic and elementary intrusion techniques, the presence of poor cyber hygiene and exposed assets can escalate these threats, leading to significant consequences such as defacement, configuration changes, operational disruptions and, in severe cases, physical damage. | CISA |
| May 6, 2025 | FBI | Alert | Primary Mitigations to Reduce Cyber Threats to Operational Technology The authoring organizations urge critical infrastructure entities to review and act now to improve their cybersecurity posture against cyber threat activities specifically and intentionally targeting internet connected OT and ICS. The authoring organizations recommend critical infrastructure asset owners and operators implement the following mitigations1 to defend against OT cyber threats. internet. | CISA, DOE, EPA, FBI |
| May 6, 2025 | CISA | ICS Advisory | ICSA-25-126-02: Milesight UG65-868M-EA Successful exploitation of this vulnerability could allow any user with admin privileges to inject arbitrary shell commands. | CISA |
| May 6, 2025 | CISA | ICS Advisory | ICSA-25-126-01: Optigo Networks ONS NC600 Successful exploitation of this vulnerability could allow an attacker to establish an authenticated connection with the hard-coded credentials and perform OS command executions. | CISA |
| May 6, 2025 | CISA | ICS Advisory | ICSA-25-126-03: BrightSign Players (Update A) Successful exploitation of these vulnerabilities could allow privilege escalation on the device, easily-guessable passwords, or arbitrary code to be executed on the underlying operating system. | CISA |
| May 1, 2025 | CISA | Alert | CISA Releases Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-121-01 KUNBUS GmbH Revolution Pi ICSMA-25-121-01 MicroDicom DICOM Viewer This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| May 1, 2025 | CISA | ICS Advisory | ICSA-25-121-01: KUNBUS GmbH Revolution Pi (Update A) Successful exploitation of these vulnerabilities could allow attackers to bypass authentication, gain unauthorized access to critical functions, and execute malicious server-side includes (SSI) within a web page. | CISA |
| May 1, 2025 | CISA | ICS Medical Advisory | ICSMA-25-121-01: MicroDicom DICOM Viewer Successful exploitation of these vulnerabilities could allow an attacker to disclose information, cause memory corruption, and execute arbitrary code. | CISA |