Tag: ot-ics
44 entries tagged ot-ics, latest activity first.
- Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets and, on 2026-11-02, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany; responsibility not established; CERT-FR and NCSC Switzerland say to remove internet exposure
- CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced ships a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in industrial, building and network-access products: Belden NetModule NRSW is fixed in 5.0.0.105 and macmon 6.x must move to 7.x, with notices from Schneider Electric, B&R, HMS Networks, Wibu-Systems, Johnson Controls and Oracle
- Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE; a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths
- CVE-2025-15467, Siemens Desigo CC: a vendored OpenSSL CMS parsing overflow gives pre-auth code execution, and the V7 family still has no fix (CVSS 9.8)
- NTC finds default passwords, fleet-wide shared credentials and unauthenticated grid-feed shutoff across Swiss solar inverters, with a named cantonal procurement gap
- NCSC UK advisory: increased targeting of internet-exposed OT and edge devices globally, including the UK, by state and non-state actors, with 'some limited real-world disruption'
- Claroty Team82: Danfoss AK-SM 800A refrigeration system managers, undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices
- Nozomi Networks/CBC: Winnipeg's largest hospital network loses HVAC and door-access central monitoring to a ransomware incident with no named actor, access vector, or ransomware family disclosed 18 days later
- Johnson Controls C-CURE 9000 / victor: unauthenticated adjacent-network deserialization RCE on physical access-control application servers reaches connected security-workstation clients too (CVE-2026-21655, CVSS 9.6)
- Rapid7's Q2 2026 quarterly report: high- and critical-severity disclosures doubled year on year to 8,539 while the number newly exploited held flat at 40, and 62% of what was exploited needed no user interaction at all
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
- Five US agencies warn of an active threat to Siemens S7 PLCs, AI-written Python tooling built on the standard S7 libraries, dressed as legitimate OT monitoring software
- Mustang Panda's CoolClient backdoor gains a kernel driver signed with a 2013 certificate that expired in 2014, and it hides the malware's own C2 traffic by hooking the driver Windows uses to report network state
- Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults
- CVE-2026-19188, Haiwell IoT Cloud HMI Gateway: the diagnostic ping in the web interface runs attacker-supplied shell commands as root, unauthenticated (CVSS 10.0)
- Coordinated two-day cyberattack disrupts operational technology at 30+ Minnesota water and wastewater utilities; no authority has attributed it
- CERT Polska: a second Polish CHP plant was shut down on 29 December 2025 through the distribution operator's private APN, the first real-world use of that path into an OT network
- CISA publishes five protocol-level flaws in CPDLC over ATN-B1, reported by a Swiss armasuisse researcher, no mitigation available, and CISA assesses exploitation unlikely outside a lab
- CVE-2026-17583, Thermo Fisher Applied Biosystems genetic analyzers write DNA result files with no integrity checking, so results can be altered after the run and no vendor fix is offered
- CVE-2026-7849 and 19 more, Phoenix Contact CHARX SEC-3xxx EV charging controllers: unauthenticated command injection as root, unsigned firmware updates, and no fix released at disclosure
- MZ Automation libIEC61850: unauthenticated heap-overflow RCE via crafted MMS Initiate (CVE-2026-49035) plus four sibling OT-library flaws
- US agencies expand the Iranian PLC-intrusion advisory (AA26-097A) to Schneider Electric and Siemens controllers, with new project-file tampering detection
- CVE-2025-40948/-40947/-40949, Siemens RUGGEDCOM ROX II: Unit 42 chains three OT-switch flaws to persistent root
- CVE-2023-4346, KNX building-automation protocol: account-lockout DoS added to CISA KEV, no software patch (CVSS 7.5)
- CISA ICS batch (14 Jul): Rockwell 1715-AENTR unauthenticated debug-port takeover (CVE-2026-10577, CVSS 10.0, fixed in firmware 3.011) and a Swiss-vendor ABB T-MAC Plus auth chain (CVSS 9.9)
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions
- CVE-2026-4769, WAGO I/O System Field: undocumented early-boot interface allows unauthenticated full compromise (CVSS 9.8)
- Siemens SICAM 8 (A8000/EGS/S8000) grid RTUs: firmware-signature-validation bypass + OPC-UA-off-by-default among four CVEs (SSA-229470)
- Cisco Talos batch disclosure: wolfSSL PKI name-constraint bypasses, GeoVision command injection, and a VTK-DICOM heap overflow (41 CVEs)
- CVE-2026-14480, OpenPLC v3 Runtime: authenticated arbitrary file write escalates to native RCE via the auto-compile pipeline (CVSS 9.9)
- Nozomi documents two new Golang IoT/Linux DDoS botnets (Apex2, c2c/meow) built for speed and reuse over sophistication
- CVE-2026-20744, Hydro-Québec EV-charging backend: unauthenticated OCPP WebSocket endpoint enables privilege escalation
- CVE-2025-67038, Lantronix EDS5000 serial-to-IP converter: unauthenticated OS command injection to root, first BRIDGE:BREAK flaw added to CISA KEV
- AryStinger: a reconnaissance-and-proxy botnet built on end-of-life D-Link routers and QNAP NAS
- CVE-2026-40624, AVer PTC-series conference cameras: unauthenticated RCE via the management web interface
- CVE-2026-0647 et al. Rockwell Automation FLEX I/O unauthenticated password reset (CVSS 9.4) and Logix CIP denial-of-service, flagged by NCSC-CH
- Cyber Europe 2026 tests the revised EU Cyber Blueprint and triggers the first live activation of the EU Cybersecurity Reserve
- Dragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion pattern
- Cisco Talos maps the DICOM-format attack surface against Orthanc PACS, network-ingested medical images as a heap out-of-bounds-write primitive
- CVE-2026-9642, Delta Electronics DIAView SCADA: incomplete fix for prior unauthenticated remote database access (CVE-2025-62582)
- Symantec and Carbon Black: the fast16 sabotage framework corrupted LS-DYNA and AUTODYN nuclear-detonation simulations; Kim Zetter argues it was contemporaneous with Stuxnet
- Poland's ABW: attackers breached five municipal water treatment plants in 2025 and in some cases altered equipment parameters, and hacktivists exploited weak passwords on exposed management panels at municipal sites
- Dragos OT Cybersecurity Year in Review (2025 data): 81% of assessments found poor IT/OT segmentation and 73% of all-time IR cases involved compromised VPN or jump-host credentials