Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3815 vulnerabilities
CVE-2025-71409 (GCVE-0-2025-71409)
Vulnerability from cvelistv5 – Published: 2026-08-07 19:02 – Updated: 2026-08-07 19:02
VLAI
EPSS
VEX
Title
No Authentication for Very High Frequency Data Link messages used in CPDLC
Summary
Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
Date Public
2026-08-07 18:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CPDLC",
"vendor": "ATN-B1",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Strohmeier of Armasuisse reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-07T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency."
}
],
"value": "Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T19:02:50.109Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"
}
],
"source": {
"advisory": "ICSA-26-219-01",
"discovery": "EXTERNAL"
},
"title": "No Authentication for Very High Frequency Data Link messages used in CPDLC",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.\u003cbr\u003e"
}
],
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-71409",
"datePublished": "2026-08-07T19:02:50.109Z",
"dateReserved": "2026-08-04T20:31:35.645Z",
"dateUpdated": "2026-08-07T19:02:50.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71410 (GCVE-0-2025-71410)
Vulnerability from cvelistv5 – Published: 2026-08-07 19:02 – Updated: 2026-08-07 19:02
VLAI
EPSS
VEX
Title
Malicious Link Control Frames Can Cause Loss of CPDLC Functions
Summary
Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
Date Public
2026-08-07 18:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CPDLC",
"vendor": "ATN-B1",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Strohmeier of Armasuisse reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-07T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency."
}
],
"value": "Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T19:02:15.353Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"
}
],
"source": {
"advisory": "ICSA-26-219-01",
"discovery": "EXTERNAL"
},
"title": "Malicious Link Control Frames Can Cause Loss of CPDLC Functions",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.\u003cbr\u003e"
}
],
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-71410",
"datePublished": "2026-08-07T19:02:15.353Z",
"dateReserved": "2026-08-04T20:31:35.645Z",
"dateUpdated": "2026-08-07T19:02:15.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71411 (GCVE-0-2025-71411)
Vulnerability from cvelistv5 – Published: 2026-08-07 19:01 – Updated: 2026-08-07 19:01
VLAI
EPSS
VEX
Title
In CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft Simultaneously
Summary
Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
Date Public
2026-08-07 18:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CPDLC",
"vendor": "ATN-B1",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Strohmeier of Armasuisse reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-07T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency."
}
],
"value": "Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T19:01:48.118Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"
}
],
"source": {
"advisory": "ICSA-26-219-01",
"discovery": "EXTERNAL"
},
"title": "In CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft Simultaneously",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.\u003cbr\u003e"
}
],
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-71411",
"datePublished": "2026-08-07T19:01:48.118Z",
"dateReserved": "2026-08-04T20:31:35.645Z",
"dateUpdated": "2026-08-07T19:01:48.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71412 (GCVE-0-2025-71412)
Vulnerability from cvelistv5 – Published: 2026-08-07 19:01 – Updated: 2026-08-07 19:01
VLAI
EPSS
VEX
Title
In CPDLC, False Emergency or Status Messages Will be Accepted as Legitimate
Summary
Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
Date Public
2026-08-07 18:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CPDLC",
"vendor": "ATN-B1",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Strohmeier of Armasuisse reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-07T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency."
}
],
"value": "Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T19:01:23.670Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"
}
],
"source": {
"advisory": "ICSA-26-219-01",
"discovery": "EXTERNAL"
},
"title": "In CPDLC, False Emergency or Status Messages Will be Accepted as Legitimate",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.\u003cbr\u003e"
}
],
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-71412",
"datePublished": "2026-08-07T19:01:23.670Z",
"dateReserved": "2026-08-04T20:31:35.645Z",
"dateUpdated": "2026-08-07T19:01:23.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71413 (GCVE-0-2025-71413)
Vulnerability from cvelistv5 – Published: 2026-08-07 19:00 – Updated: 2026-08-07 19:00
VLAI
EPSS
VEX
Title
In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets
Summary
Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
Date Public
2026-08-07 18:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CPDLC",
"vendor": "ATN-B1",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Strohmeier of Armasuisse reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-07T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency."
}
],
"value": "Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T19:00:53.989Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"
}
],
"source": {
"advisory": "ICSA-26-219-01",
"discovery": "EXTERNAL"
},
"title": "In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.\u003cbr\u003e"
}
],
"value": "These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-71413",
"datePublished": "2026-08-07T19:00:53.989Z",
"dateReserved": "2026-08-04T20:31:35.645Z",
"dateUpdated": "2026-08-07T19:00:53.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17264 (GCVE-0-2026-17264)
Vulnerability from cvelistv5 – Published: 2026-08-06 22:13 – Updated: 2026-08-07 13:19
VLAI
EPSS
VEX
Title
Medixant RadiAnt DICOM Out-of-bounds write
Summary
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Medixant | RadiAnt DICOM |
Affected:
0 , ≤ 2025.2
(custom)
Unaffected: 2026.1 |
Date Public
2026-08-06 17:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T13:19:23.387560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T13:19:33.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RadiAnt DICOM",
"vendor": "Medixant",
"versions": [
{
"lessThanOrEqual": "2025.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "banda, oriotie, ax123, jihyeon4725, lacroix, minzu reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-06T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code."
}
],
"value": "Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T22:13:03.902Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-218-01"
},
{
"url": "https://www.radiantviewer.com/files/RadiAnt-2026.1-Setup.exe"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-218-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users should update to version \u003ca href=\"https://www.radiantviewer.com/files/RadiAnt-2026.1-Setup.exe\"\u003e2026.1\u003c/a\u003e. It is also recommended to open DICOM files only from trusted and reliable sources. Additionally, the application is compiled with exploit mitigation mechanisms enabled, including Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which significantly reduces the practical exploitability of the issue."
}
],
"value": "Users should update to version 2026.1 https://www.radiantviewer.com/files/RadiAnt-2026.1-Setup.exe . It is also recommended to open DICOM files only from trusted and reliable sources. Additionally, the application is compiled with exploit mitigation mechanisms enabled, including Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which significantly reduces the practical exploitability of the issue."
}
],
"source": {
"advisory": "ICSMA-26-218-01",
"discovery": "EXTERNAL"
},
"title": "Medixant RadiAnt DICOM Out-of-bounds write",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-17264",
"datePublished": "2026-08-06T22:13:03.902Z",
"dateReserved": "2026-07-24T22:43:28.491Z",
"dateUpdated": "2026-08-07T13:19:33.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17583 (GCVE-0-2026-17583)
Vulnerability from cvelistv5 – Published: 2026-08-05 20:23 – Updated: 2026-08-06 13:34
VLAI
EPSS
VEX
Title
Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check
Summary
The affected
Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thermo Fisher | Applied Biosystems 3500/3500xL Series Data Collection Software |
Affected:
0 , ≤ 4.0.2
(custom)
|
|
| Thermo Fisher | Applied Biosystems 3730/3730xL Series Data Collection Software |
Affected:
0 , ≤ 5.0.2
(custom)
|
|
| Thermo Fisher | Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software |
Affected:
0 , ≤ 1.2.5
(custom)
|
|
| Thermo Fisher | Applied Biosystems SeqStudio Flex Series Instrument Software |
Affected:
0 , ≤ 1.2.0
(custom)
|
|
| Thermo Fisher | Applied Biosystems GeneMapper ID-X Software |
Affected:
0 , ≤ 1.7.3
(custom)
|
|
| Thermo Fisher | Applied Biosystems 3130 Series Data Collection Software |
Affected:
0 , ≤ 4.1
(custom)
|
|
| Thermo Fisher | ABI PRISM 3100/3100-Avant Data Collection Software |
Affected:
0 , ≤ 2.0
(custom)
|
|
| Thermo Fisher | ABI PRISM 310 Data Collection Software |
Affected:
0 , ≤ 3.1
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T13:34:47.788856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T13:34:57.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems 3500/3500xL Series Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "4.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems 3730/3730xL Series Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "1.2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems SeqStudio Flex Series Instrument Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems GeneMapper ID-X Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "1.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Applied Biosystems 3130 Series Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ABI PRISM 3100/3100-Avant Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ABI PRISM 310 Data Collection Software",
"vendor": "Thermo Fisher",
"versions": [
{
"lessThanOrEqual": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nathaniel Adams, Laura Gaydosh-Combs, and Kevin Dyer reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eThe affected\u003c/span\u003e\n\nThermo Fisher Applied Biosystems Genetic Analyzers are\u003cspan\u003e\u0026nbsp;vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.\u003c/span\u003e"
}
],
"value": "The affected\n\nThermo Fisher Applied Biosystems Genetic Analyzers are\u00a0vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "CWE-353",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T20:23:32.890Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-216-01"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17583"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified.\u003c/p\u003e\u003cp\u003eApplied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3\u003cbr\u003e\u003ca href=\"https://downloads.thermofisher.com/3500_DCS_v4.0.3_Patch/v4.0.3_Patch_Installer.exe\"\u003ehttps://downloads.thermofisher.com/3500_DCS_v4.0.3_Patch/v4.0.3_Patch_Installer.exe\u003c/a\u003e\u003c/p\u003e\u003cp\u003eApplied Biosystems 3730/3730xL Series Data Collection Software: Update to version 5.0.3\u003cbr\u003e\u003ca href=\"https://downloads.thermofisher.com/3730xl_UDC_v5.0.3_Patch/3730xl_UDC_v5.0.3_Patch.exe\"\u003ehttps://downloads.thermofisher.com/3730xl_UDC_v5.0.3_Patch/3730xl_UDC_v5.0.3_Patch.exe\u003c/a\u003e\u003c/p\u003e\u003cp\u003eApplied Biosystems SeqStudio Genetic Analyzer Data Collection Software: Update to version 1.2.6\u003cbr\u003e\u003ca href=\"https://downloads.thermofisher.com/SeqStudio/1.2.6/SeqStudio-1.2.6.abpkg\"\u003ehttps://downloads.thermofisher.com/SeqStudio/1.2.6/SeqStudio-1.2.6.abpkg\u003c/a\u003e\u003c/p\u003e\u003cp\u003eApplied Biosystems SeqStudio Flex Series Instrument Software: Update to version 1.2.1\u003cbr\u003e\u003ca href=\"https://downloads.thermofisher.com/SeqStudioFlex/1.2.1/SeqStudioFlex-1.2.1.abpkg\"\u003ehttps://downloads.thermofisher.com/SeqStudioFlex/1.2.1/SeqStudioFlex-1.2.1.abpkg\u003c/a\u003e\u003c/p\u003e\u003cp\u003eApplied Biosystems GeneMapper ID-X Software: Update to version 1.7.4\u003cbr\u003e\u003ca href=\"https://downloads.thermofisher.com/GeneMapperID-Xv1.7.4_Patch/GMIDX_v1.7.4_Patch.exe\"\u003ehttps://downloads.thermofisher.com/GeneMapperID-Xv1.7.4_Patch/GMIDX_v1.7.4_Patch.exe\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified.\n\n\n\nApplied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3\n https://downloads.thermofisher.com/3500_DCS_v4.0.3_Patch/v4.0.3_Patch_Installer.exe \n\n\n\nApplied Biosystems 3730/3730xL Series Data Collection Software: Update to version 5.0.3\n https://downloads.thermofisher.com/3730xl_UDC_v5.0.3_Patch/3730xl_UDC_v5.0.3_Patch.exe \n\n\n\nApplied Biosystems SeqStudio Genetic Analyzer Data Collection Software: Update to version 1.2.6\n https://downloads.thermofisher.com/SeqStudio/1.2.6/SeqStudio-1.2.6.abpkg \n\n\n\nApplied Biosystems SeqStudio Flex Series Instrument Software: Update to version 1.2.1\n https://downloads.thermofisher.com/SeqStudioFlex/1.2.1/SeqStudioFlex-1.2.1.abpkg \n\n\n\nApplied Biosystems GeneMapper ID-X Software: Update to version 1.7.4\n https://downloads.thermofisher.com/GeneMapperID-Xv1.7.4_Patch/GMIDX_v1.7.4_Patch.exe"
}
],
"source": {
"advisory": "ICSMA-26-216-01",
"discovery": "EXTERNAL"
},
"title": "Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplied Biosystems 3130 Series Data Collection Software: Product is End of Life (EoL), no update provided\u003cbr\u003eABI PRISM 3100/3100-Avant Data Collection Software: Product is End of Life (EoL), no update provided\u003cbr\u003eABI PRISM 310 Data Collection Software: Product is End of Life (EoL), no update provided\u003c/p\u003e\u003cp\u003eFor users who are unable to immediately implement all applicable security updates, Thermo Fisher Scientific recommends implementing the following interim mitigation measures until the applicable updates have been installed:\u0026nbsp;\u003c/p\u003e\u003cul\u003e\u003cli\u003eMaintain a secure chain of custody for files generated by the HID instrumentation throughout the analysis workflow.\u003c/li\u003e\u003cli\u003eStore generated files on encrypted, password-protected storage media (for example, encrypted USB drives or encrypted hard drives).\u003c/li\u003e\u003cli\u003eRestrict access to generated files to authorized personnel in accordance with your laboratory\u0027s access control policies.\u003c/li\u003e\u003cli\u003eApply the principle of least privilege by limiting user permissions on systems operating the HID instrumentation or hosting associated data analysis and secondary analysis software.\u003c/li\u003e\u003cli\u003eLeverage firewall rules and network access control lists (NACLs) to restrict internet connectivity to only trusted sources.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, refer to Thermo Fisher\u0027s security bulletin.\u003cbr\u003e\u003ca href=\"https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf\"\u003ehttps://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Applied Biosystems 3130 Series Data Collection Software: Product is End of Life (EoL), no update provided\nABI PRISM 3100/3100-Avant Data Collection Software: Product is End of Life (EoL), no update provided\nABI PRISM 310 Data Collection Software: Product is End of Life (EoL), no update provided\n\n\n\nFor users who are unable to immediately implement all applicable security updates, Thermo Fisher Scientific recommends implementing the following interim mitigation measures until the applicable updates have been installed:\u00a0\n\n * Maintain a secure chain of custody for files generated by the HID instrumentation throughout the analysis workflow.\n * Store generated files on encrypted, password-protected storage media (for example, encrypted USB drives or encrypted hard drives).\n * Restrict access to generated files to authorized personnel in accordance with your laboratory\u0027s access control policies.\n * Apply the principle of least privilege by limiting user permissions on systems operating the HID instrumentation or hosting associated data analysis and secondary analysis software.\n * Leverage firewall rules and network access control lists (NACLs) to restrict internet connectivity to only trusted sources.\n\n\n\n\nFor more information, refer to Thermo Fisher\u0027s security bulletin.\n https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-17583",
"datePublished": "2026-08-05T20:23:32.890Z",
"dateReserved": "2026-07-27T15:53:40.951Z",
"dateUpdated": "2026-08-06T13:34:57.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18411 (GCVE-0-2026-18411)
Vulnerability from cvelistv5 – Published: 2026-08-05 20:13 – Updated: 2026-08-06 13:46
VLAI
EPSS
VEX
Title
Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100
Summary
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T13:46:38.715758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T13:46:47.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "KARR BT",
"vendor": "Acrisure",
"versions": [
{
"status": "affected",
"version": "Versions prior to July 20, 2026"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR-100",
"vendor": "Acrisure",
"versions": [
{
"status": "affected",
"version": "Versions prior to July 20, 2026"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Schulman, Jerry Yu, Yibo Wei, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff, and Nishant Bhaskar of UC San Diego team discovered this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.\u0026nbsp;\u003cbr\u003e"
}
],
"value": "The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T20:13:13.067Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-216-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability. They recommend that affected users should follow the directions found here: https://www.karrsecurity.com/karr-security-firmware-update-instructions."
}
],
"value": "Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability. They recommend that affected users should follow the directions found here: https://www.karrsecurity.com/karr-security-firmware-update-instructions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-18411",
"datePublished": "2026-08-05T20:13:13.067Z",
"dateReserved": "2026-07-30T17:01:44.405Z",
"dateUpdated": "2026-08-06T13:46:47.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61893 (GCVE-0-2026-61893)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:58 – Updated: 2026-07-31 16:00
VLAI
EPSS
VEX
Title
MZ Automation lib60870 Out-of-bounds Read
Summary
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an
inflated object count causes TestCommand_getFromBuffer to read one byte
past the end of the heap-allocated message buffer.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation | lib60870 |
Affected:
2.4.0
Unaffected: 2.4.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61893",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:59:46.080967Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T16:00:07.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lib60870",
"vendor": "MZ Automation",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arun babu puthuparambil of Central Power Research Institute, Bengaluru, India reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an \ninflated object count causes TestCommand_getFromBuffer to read one byte \npast the end of the heap-allocated message buffer."
}
],
"value": "A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an \ninflated object count causes TestCommand_getFromBuffer to read one byte \npast the end of the heap-allocated message buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:58:32.226Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMZ Automation recommends users update to version 2.4.1 when available.\u003cbr\u003eSee MZ Automation advisory for more \ninformation:\u0026nbsp;\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm\"\u003ehttps://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm\n\n\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "MZ Automation recommends users update to version 2.4.1 when available.\nSee MZ Automation advisory for more \ninformation:\u00a0\u00a0\nhttps://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm"
}
],
"source": {
"advisory": "ICSA-26-211-11",
"discovery": "EXTERNAL"
},
"title": "MZ Automation lib60870 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-61893",
"datePublished": "2026-07-30T22:58:32.226Z",
"dateReserved": "2026-07-16T22:10:53.022Z",
"dateUpdated": "2026-07-31T16:00:07.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63033 (GCVE-0-2026-63033)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:54 – Updated: 2026-07-31 19:23
VLAI
EPSS
VEX
Title
MZ Automation lib60870 Out-of-bounds Read
Summary
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding
what fits in the ASDU body causes InformationObject_ParseObjectAddress
to read one byte past the end of the heap-allocated message buffer.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation | lib60870 |
Affected:
2.4.0
Unaffected: 2.4.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63033",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:23:16.206329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:23:47.085Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lib60870",
"vendor": "MZ Automation",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arun babu puthuparambil of Central Power Research Institute, Bengaluru, India reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A crafted IEC 60870-5-104 I-frame with a declared object count exceeding\n what fits in the ASDU body causes InformationObject_ParseObjectAddress \nto read one byte past the end of the heap-allocated message buffer."
}
],
"value": "A crafted IEC 60870-5-104 I-frame with a declared object count exceeding\n what fits in the ASDU body causes InformationObject_ParseObjectAddress \nto read one byte past the end of the heap-allocated message buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:54:25.681Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMZ Automation recommends users update to version 2.4.1 when available.\u003cbr\u003eSee MZ Automation advisory for more \ninformation:\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7\"\u003ehttps://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "MZ Automation recommends users update to version 2.4.1 when available.\nSee MZ Automation advisory for more \ninformation:\u00a0\n https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7"
}
],
"source": {
"advisory": "ICSA-26-211-11",
"discovery": "EXTERNAL"
},
"title": "MZ Automation lib60870 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-63033",
"datePublished": "2026-07-30T22:54:25.681Z",
"dateReserved": "2026-07-16T22:10:53.026Z",
"dateUpdated": "2026-07-31T19:23:47.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66720 (GCVE-0-2026-66720)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:46 – Updated: 2026-07-31 15:58
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The GOOSE subscriber component improperly validates the UTC timestamp
field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2
multicast messages. A specially crafted GOOSE frame containing an
undersized timestamp field can trigger a heap out-of-bounds read during
message processing, causing the process to crash and resulting in a
denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:58:19.286751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:58:46.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The GOOSE subscriber component improperly validates the UTC timestamp \nfield in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 \nmulticast messages. A specially crafted GOOSE frame containing an \nundersized timestamp field can trigger a heap out-of-bounds read during \nmessage processing, causing the process to crash and resulting in a \ndenial-of-service condition."
}
],
"value": "The GOOSE subscriber component improperly validates the UTC timestamp \nfield in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 \nmulticast messages. A specially crafted GOOSE frame containing an \nundersized timestamp field can trigger a heap out-of-bounds read during \nmessage processing, causing the process to crash and resulting in a \ndenial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:46:52.453Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66720",
"datePublished": "2026-07-30T22:46:52.453Z",
"dateReserved": "2026-07-27T19:32:49.387Z",
"dateUpdated": "2026-07-31T15:58:46.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66369 (GCVE-0-2026-66369)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:45 – Updated: 2026-07-31 19:22
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The GOOSE parser contains an off-by-one boundary-handling flaw that can
be triggered by a single unauthenticated Layer-2 multicast frame on the
process bus. When specific GOOSE message fields are processed, the
parser advances its internal buffer position incorrectly, resulting in a
heap out-of-bounds read. On affected platforms, this condition reliably
terminates the subscriber process and causes a denial-of-service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:22:09.124532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:22:19.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The GOOSE parser contains an off-by-one boundary-handling flaw that can \nbe triggered by a single unauthenticated Layer-2 multicast frame on the \nprocess bus. When specific GOOSE message fields are processed, the \nparser advances its internal buffer position incorrectly, resulting in a\n heap out-of-bounds read. On affected platforms, this condition reliably\n terminates the subscriber process and causes a denial-of-service."
}
],
"value": "The GOOSE parser contains an off-by-one boundary-handling flaw that can \nbe triggered by a single unauthenticated Layer-2 multicast frame on the \nprocess bus. When specific GOOSE message fields are processed, the \nparser advances its internal buffer position incorrectly, resulting in a\n heap out-of-bounds read. On affected platforms, this condition reliably\n terminates the subscriber process and causes a denial-of-service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:45:29.375Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66369",
"datePublished": "2026-07-30T22:45:29.375Z",
"dateReserved": "2026-07-27T19:32:49.390Z",
"dateUpdated": "2026-07-31T19:22:19.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63550 (GCVE-0-2026-63550)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:43 – Updated: 2026-07-31 15:57
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The MMS BER decoder contains a boundary-handling flaw in the processing
of certain fields within confirmed-request messages. When a crafted
BER-encoded element is received over an established MMS session (TCP
port 102), the decoder may advance its internal read position
incorrectly, leading to a heap out-of-bounds read. This condition causes
the MMS handling process to terminate unexpectedly, resulting in a
denial-of-service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:55:55.366699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:57:05.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service."
}
],
"value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:43:21.063Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-63550",
"datePublished": "2026-07-30T22:43:21.063Z",
"dateReserved": "2026-07-27T19:32:49.393Z",
"dateUpdated": "2026-07-31T15:57:05.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65421 (GCVE-0-2026-65421)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:35 – Updated: 2026-07-31 15:55
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The MMS BER decoder contains a flaw in decoding fixed-width BER fields
(boolean/integer): an attacker-supplied length value is not validated,
causing a read past the end of a heap buffer. This leads to termination
of the MMS service process and a denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:55:24.858279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:55:36.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The MMS BER decoder contains a flaw in decoding fixed-width BER fields \n(boolean/integer): an attacker-supplied length value is not validated, \ncausing a read past the end of a heap buffer. This leads to termination \nof the MMS service process and a denial-of-service condition."
}
],
"value": "The MMS BER decoder contains a flaw in decoding fixed-width BER fields \n(boolean/integer): an attacker-supplied length value is not validated, \ncausing a read past the end of a heap buffer. This leads to termination \nof the MMS service process and a denial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:35:14.668Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-65421",
"datePublished": "2026-07-30T22:35:14.668Z",
"dateReserved": "2026-07-27T19:32:49.396Z",
"dateUpdated": "2026-07-31T15:55:36.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66364 (GCVE-0-2026-66364)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:33 – Updated: 2026-07-31 15:55
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The GOOSE payload parser contains a boundary handling flaw that can be
triggered by a single unauthenticated Layer 2 multicast frame on the
process bus. When processing specific payload fields, an attacker
controlled inner element length may exceed its enclosing length, causing
the parser to over read by one byte. This out-of-bounds read reliably
terminates the subscriber process, resulting in a denial-of-service
condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:55:04.188808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:55:15.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition."
}
],
"value": "The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:33:28.104Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66364",
"datePublished": "2026-07-30T22:33:28.104Z",
"dateReserved": "2026-07-27T19:32:49.399Z",
"dateUpdated": "2026-07-31T15:55:15.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66349 (GCVE-0-2026-66349)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:31 – Updated: 2026-07-31 15:54
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The MMS server connection handler contains a flaw in its processing of
BER-encoded request data. When an MMS confirmed request PDU containing
an extended BER tag is received over an established session, the decoder
may advance its internal buffer incorrectly due to a missing bounds
check. This results in a one byte heap out-of-bounds read and causes the
MMS service process to terminate, leading to a denial-of-service
condition.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:53:07.188073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:54:00.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The MMS server connection handler contains a flaw in its processing of \nBER-encoded request data. When an MMS confirmed request PDU containing \nan extended BER tag is received over an established session, the decoder\n may advance its internal buffer incorrectly due to a missing bounds \ncheck. This results in a one byte heap out-of-bounds read and causes the\n MMS service process to terminate, leading to a denial-of-service \ncondition."
}
],
"value": "The MMS server connection handler contains a flaw in its processing of \nBER-encoded request data. When an MMS confirmed request PDU containing \nan extended BER tag is received over an established session, the decoder\n may advance its internal buffer incorrectly due to a missing bounds \ncheck. This results in a one byte heap out-of-bounds read and causes the\n MMS service process to terminate, leading to a denial-of-service \ncondition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:31:32.618Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66349",
"datePublished": "2026-07-30T22:31:32.618Z",
"dateReserved": "2026-07-27T19:32:49.401Z",
"dateUpdated": "2026-07-31T15:54:00.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56758 (GCVE-0-2026-56758)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:29 – Updated: 2026-07-31 15:52
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS
connection establishment. When parsing certain fields within the
calling AP title, an attacker controlled length value of zero or one may
cause the parser to read past the end of a heap buffer.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:52:03.414515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:52:20.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS\n connection establishment. When parsing certain fields within the \ncalling AP title, an attacker controlled length value of zero or one may\n cause the parser to read past the end of a heap buffer."
}
],
"value": "The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS\n connection establishment. When parsing certain fields within the \ncalling AP title, an attacker controlled length value of zero or one may\n cause the parser to read past the end of a heap buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:29:20.516Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-56758",
"datePublished": "2026-07-30T22:29:20.516Z",
"dateReserved": "2026-07-27T19:32:49.404Z",
"dateUpdated": "2026-07-31T15:52:20.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66360 (GCVE-0-2026-66360)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:25 – Updated: 2026-07-31 15:50
VLAI
EPSS
VEX
Title
MZ Automation libiec61850 Out-of-bounds Read
Summary
The ISO Presentation layer contains a flaw in the handling of specific
parameters during normal mode negotiation. A missing length check in the
processing of the encoded presentation data allows an attacker
controlled field with a zero length value to trigger a bounded heap over
read. This condition occurs before MMS session establishment, a crafted
TCP/102 connection attempt can trigger the issue. The resulting over
read causes the process to terminate, leading to a denial of service
condition.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MZ Automation GmbH | libiec61850 |
Affected:
0 , < 1.6.2
(custom)
Unaffected: 1.6.2 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:50:13.939405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:50:41.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libiec61850",
"vendor": "MZ Automation GmbH",
"versions": [
{
"lessThan": "1.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arun Babu of Central Power Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The ISO Presentation layer contains a flaw in the handling of specific \nparameters during normal mode negotiation. A missing length check in the\n processing of the encoded presentation data allows an attacker \ncontrolled field with a zero length value to trigger a bounded heap over\n read. This condition occurs before MMS session establishment, a crafted\n TCP/102 connection attempt can trigger the issue. The resulting over \nread causes the process to terminate, leading to a denial of service \ncondition."
}
],
"value": "The ISO Presentation layer contains a flaw in the handling of specific \nparameters during normal mode negotiation. A missing length check in the\n processing of the encoded presentation data allows an attacker \ncontrolled field with a zero length value to trigger a bounded heap over\n read. This condition occurs before MMS session establishment, a crafted\n TCP/102 connection attempt can trigger the issue. The resulting over \nread causes the process to terminate, leading to a denial of service \ncondition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:25:54.454Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"value": "MZ Automation GmbH recommends that users update to version 1.6.2."
}
],
"source": {
"advisory": "ICSA-26-211-10",
"discovery": "EXTERNAL"
},
"title": "MZ Automation libiec61850 Out-of-bounds Read",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66360",
"datePublished": "2026-07-30T22:25:54.454Z",
"dateReserved": "2026-07-27T19:32:49.407Z",
"dateUpdated": "2026-07-31T15:50:41.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63362 (GCVE-0-2026-63362)
Vulnerability from cvelistv5 – Published: 2026-07-30 22:01 – Updated: 2026-07-31 15:48
VLAI
EPSS
VEX
Title
o6 Automation open62541 Integer Underflow
Summary
An unsigned integer underflow in the PubSub signature verification path
in open62541 may allow a remote attacker to cause a denial of service
via a crafted UDP packet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| o6 Automation | open62541 |
Affected:
1.3.0 , ≤ 1.3.17
(custom)
Affected: 1.4.0 , ≤ 1.4.16 (custom) Affected: 1.5.0 , ≤ 1.5.4 (custom) Affected: master |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:48:12.482282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:48:40.485Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "open62541",
"vendor": "o6 Automation",
"versions": [
{
"lessThanOrEqual": "1.3.17",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "master"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unsigned integer underflow in the PubSub signature verification path \nin open62541 may allow a remote attacker to cause a denial of service \nvia a crafted UDP packet."
}
],
"value": "An unsigned integer underflow in the PubSub signature verification path \nin open62541 may allow a remote attacker to cause a denial of service \nvia a crafted UDP packet."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T22:01:48.523Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.o6-automation.com/contact"
},
{
"url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f"
},
{
"url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60"
},
{
"url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e"
},
{
"url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\nor by downloading from the \nfollowing locations:\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "o6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u00a0\u00a0 https://www.o6-automation.com/contact \nor by downloading from the \nfollowing locations:\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \n\n\n\n\nFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u00a0 https://www.o6-automation.com/contact"
}
],
"source": {
"advisory": "ICSA-26-211-08",
"discovery": "EXTERNAL"
},
"title": "o6 Automation open62541 Integer Underflow",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-63362",
"datePublished": "2026-07-30T22:01:48.523Z",
"dateReserved": "2026-07-27T15:02:47.793Z",
"dateUpdated": "2026-07-31T15:48:40.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65423 (GCVE-0-2026-65423)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:59 – Updated: 2026-07-31 15:47
VLAI
EPSS
VEX
Title
o6 Automation open62541 Integer Overflow or Wraparound
Summary
An integer overflow in the UA_Variant arrayDimensions product
computation in open62541 may allow a remote attacker to trigger an
out-of-bounds write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| o6 Automation | open62541 |
Affected:
1.3.0 , ≤ 1.3.17
(custom)
Affected: 1.4.0 , ≤ 1.4.16 (custom) Affected: 1.5.0 , ≤ 1.5.4 (custom) Affected: master |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:47:23.959371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:47:55.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "open62541",
"vendor": "o6 Automation",
"versions": [
{
"lessThanOrEqual": "1.3.17",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "master"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to trigger an \nout-of-bounds write."
}
],
"value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to trigger an \nout-of-bounds write."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T21:59:06.093Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.o6-automation.com/contact"
},
{
"url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f"
},
{
"url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60"
},
{
"url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e"
},
{
"url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\nor by downloading from the \nfollowing locations:\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "o6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u00a0\u00a0 https://www.o6-automation.com/contact \nor by downloading from the \nfollowing locations:\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \n\n\n\n\nFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u00a0 https://www.o6-automation.com/contact"
}
],
"source": {
"advisory": "ICSA-26-211-08",
"discovery": "EXTERNAL"
},
"title": "o6 Automation open62541 Integer Overflow or Wraparound",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-65423",
"datePublished": "2026-07-30T21:59:06.093Z",
"dateReserved": "2026-07-27T15:02:47.797Z",
"dateUpdated": "2026-07-31T15:47:55.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63035 (GCVE-0-2026-63035)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:56 – Updated: 2026-07-31 15:45
VLAI
EPSS
VEX
Title
o6 Automation open62541 Use After Free
Summary
A heap use-after-free vulnerability in the TransferSubscriptions service
in open62541 may allow an authenticated attacker to cause a denial of
service or potentially execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| o6 Automation | open62541 |
Affected:
1.3.0 , ≤ 1.3.17
(custom)
Affected: 1.4.0 , ≤ 1.4.16 (custom) Affected: 1.5.0 , ≤ 1.5.4 (custom) Affected: master |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:44:46.201061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:45:48.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "open62541",
"vendor": "o6 Automation",
"versions": [
{
"lessThanOrEqual": "1.3.17",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "master"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A heap use-after-free vulnerability in the TransferSubscriptions service\n in open62541 may allow an authenticated attacker to cause a denial of \nservice or potentially execute arbitrary code."
}
],
"value": "A heap use-after-free vulnerability in the TransferSubscriptions service\n in open62541 may allow an authenticated attacker to cause a denial of \nservice or potentially execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T21:56:04.345Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.o6-automation.com/contact"
},
{
"url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f"
},
{
"url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60"
},
{
"url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e"
},
{
"url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\nor by downloading from the \nfollowing locations:\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "o6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u00a0\u00a0 https://www.o6-automation.com/contact \nor by downloading from the \nfollowing locations:\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \n\n\n\n\nFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u00a0 https://www.o6-automation.com/contact"
}
],
"source": {
"advisory": "ICSA-26-211-08",
"discovery": "EXTERNAL"
},
"title": "o6 Automation open62541 Use After Free",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-63035",
"datePublished": "2026-07-30T21:56:04.345Z",
"dateReserved": "2026-07-27T15:02:47.801Z",
"dateUpdated": "2026-07-31T15:45:48.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63559 (GCVE-0-2026-63559)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:47 – Updated: 2026-07-31 15:42
VLAI
EPSS
VEX
Title
o6 Automation open62541 Integer Overflow or Wraparound
Summary
An integer overflow in the UA_Variant arrayDimensions product
computation in open62541 may allow a remote attacker to read
out-of-bounds heap memory, potentially disclosing sensitive information.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| o6 Automation | open62541 |
Affected:
1.3.0 , ≤ 1.3.17
(custom)
Affected: 1.4.0 , ≤ 1.4.16 (custom) Affected: 1.5.0 , ≤ 1.5.4 (custom) Affected: master |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63559",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:42:25.786250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:42:40.025Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "open62541",
"vendor": "o6 Automation",
"versions": [
{
"lessThanOrEqual": "1.3.17",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "master"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asher Davila of Palo Alto Networks reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to read \nout-of-bounds heap memory, potentially disclosing sensitive information."
}
],
"value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to read \nout-of-bounds heap memory, potentially disclosing sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T21:47:21.231Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.o6-automation.com/contact"
},
{
"url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f"
},
{
"url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60"
},
{
"url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e"
},
{
"url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\nor by downloading from the \nfollowing locations:\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "o6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u00a0\u00a0 https://www.o6-automation.com/contact \nor by downloading from the \nfollowing locations:\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \n\n\n\n\nFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u00a0 https://www.o6-automation.com/contact"
}
],
"source": {
"advisory": "ICSA-26-211-08",
"discovery": "EXTERNAL"
},
"title": "o6 Automation open62541 Integer Overflow or Wraparound",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-63559",
"datePublished": "2026-07-30T21:47:21.231Z",
"dateReserved": "2026-07-27T15:02:47.789Z",
"dateUpdated": "2026-07-31T15:42:40.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18064 (GCVE-0-2026-18064)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:35 – Updated: 2026-07-31 15:41
VLAI
EPSS
VEX
Title
NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
Summary
An incomplete fix for CVE-2026-15352 in the NASA core Flight System
(cFS) Health and Safety (HS) application leaves a separate NULL pointer
dereference reachable in versions through 7.0.1. An attacker who can
trigger the affected command under specific conditions could cause the
HS application to crash, resulting in a denial-of-service condition and
processor reset.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NASA | Core Flight System (cFS) Health & Safety (HS) Application |
Affected:
0 , ≤ v7.0.1
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18064",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:40:36.521992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:41:27.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Core Flight System (cFS) Health \u0026 Safety (HS) Application",
"vendor": "NASA",
"versions": [
{
"lessThanOrEqual": "v7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Holmquist of Hasp Labs reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An incomplete fix for CVE-2026-15352 in the NASA core Flight System \n(cFS) Health and Safety (HS) application leaves a separate NULL pointer \ndereference reachable in versions through 7.0.1. An attacker who can \ntrigger the affected command under specific conditions could cause the \nHS application to crash, resulting in a denial-of-service condition and \nprocessor reset."
}
],
"value": "An incomplete fix for CVE-2026-15352 in the NASA core Flight System \n(cFS) Health and Safety (HS) application leaves a separate NULL pointer \ndereference reachable in versions through 7.0.1. An attacker who can \ntrigger the affected command under specific conditions could cause the \nHS application to crash, resulting in a denial-of-service condition and \nprocessor reset."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T21:35:14.061Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://github.com/nasa/HS"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-06.json"
}
],
"source": {
"advisory": "ICSA-26-211-06",
"discovery": "EXTERNAL"
},
"title": "NASA Core Flight System (cFS) Health \u0026 Safety (HS) Application NULL Pointer Dereference",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NASA reports that an official fix is currently under development and is expected to be included in a future software release.\u003cbr\u003e\u003cbr\u003eAs an interim mitigation, users can update their HS app from the HS repo (\u003ca href=\"https://github.com/nasa/HS\"\u003ehttps://github.com/nasa/HS\u003c/a\u003e) to the latest dev branch. The fix is in the dev branch starting at commit 828855f971db4b6714367ed0a970f52dbeab2965"
}
],
"value": "NASA reports that an official fix is currently under development and is expected to be included in a future software release.\n\nAs an interim mitigation, users can update their HS app from the HS repo ( https://github.com/nasa/HS ) to the latest dev branch. The fix is in the dev branch starting at commit 828855f971db4b6714367ed0a970f52dbeab2965"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-18064",
"datePublished": "2026-07-30T21:35:14.061Z",
"dateReserved": "2026-07-28T14:10:13.503Z",
"dateUpdated": "2026-07-31T15:41:27.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12562 (GCVE-0-2026-12562)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:29 – Updated: 2026-07-31 15:39
VLAI
EPSS
VEX
Title
Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function
Summary
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated
service that exposes a debug interface granting full root-level access
to the embedded system. This vulnerability stems from a
network-accessible port running a Target Communications Framework (TCF)
service that does not require any authentication, allowing an attacker
to directly interact with the Linux environment that powers the device.
Once connected, an attacker can freely view and modify the filesystem,
manipulate running processes, and control network interfaces, enabling
deep alteration of system behavior.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Toptech Systems | RCU II+ |
Affected:
0 , < 2025-11-24
(custom)
|
|
| Toptech Systems | Multiload II+ |
Affected:
0 , < 2025-11-24
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:39:39.902412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:39:49.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RCU II+",
"vendor": "Toptech Systems",
"versions": [
{
"lessThan": "2025-11-24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Multiload II+",
"vendor": "Toptech Systems",
"versions": [
{
"lessThan": "2025-11-24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Donald Green of Southwest Research Institute reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The RCU II+ and Multiload II+ are vulnerable to an unauthenticated \nservice that exposes a debug interface granting full root-level access \nto the embedded system. This vulnerability stems from a \nnetwork-accessible port running a Target Communications Framework (TCF) \nservice that does not require any authentication, allowing an attacker \nto directly interact with the Linux environment that powers the device. \nOnce connected, an attacker can freely view and modify the filesystem, \nmanipulate running processes, and control network interfaces, enabling \ndeep alteration of system behavior."
}
],
"value": "The RCU II+ and Multiload II+ are vulnerable to an unauthenticated \nservice that exposes a debug interface granting full root-level access \nto the embedded system. This vulnerability stems from a \nnetwork-accessible port running a Target Communications Framework (TCF) \nservice that does not require any authentication, allowing an attacker \nto directly interact with the Linux environment that powers the device. \nOnce connected, an attacker can freely view and modify the filesystem, \nmanipulate running processes, and control network interfaces, enabling \ndeep alteration of system behavior."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T23:58:13.132Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip"
},
{
"url": "https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz"
},
{
"url": "https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/"
},
{
"url": "https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-03.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eToptech Systems provides two methods for remediating affected RCU II+ \nand Multiload II+ units: First, move the device to a closed or segmented\n network without untrusted access.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eRun one of the RCU II+/Multiload II+ Vulnerability Removal Tools (VRT)\n available at \n\u003ca href=\"https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip\"\u003ehttps://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip\u003c/a\u003e,\n\u003ca href=\"https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz\"\u003e \nhttps://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz\u003c/a\u003e.\n \u003c/div\u003e\u003cul\u003e\u003cli\u003eThis option does not require breaking Weights and Measures seals and has the least operational impact.\u003c/li\u003e\u003c/ul\u003eInstall the latest firmware from \n\u003ca href=\"https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/\"\u003ehttps://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/\u003c/a\u003e.\n \u003cul\u003e\u003cli\u003eThis method requires stopping the bay and breaking the W\u0026amp;M seal. \nBe sure to back up the current ML configuration before performing the \nfirmware update.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\nFor questions, contact Toptech Systems Support at security@toptech.com. \nAdditional details are available in Toptech System\u0027s firmware \nvulnerability notice: \n\u003ca href=\"https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf\"\u003ehttps://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf\u003c/a\u003e.\n\n\u003c/div\u003e"
}
],
"value": "Toptech Systems provides two methods for remediating affected RCU II+ \nand Multiload II+ units: First, move the device to a closed or segmented\n network without untrusted access.\n\n\n\n\nRun one of the RCU II+/Multiload II+ Vulnerability Removal Tools (VRT)\n available at \n https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip ,\n \nhttps://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz.\n \n\n * This option does not require breaking Weights and Measures seals and has the least operational impact.\n\n\nInstall the latest firmware from \n https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/ .\n * This method requires stopping the bay and breaking the W\u0026M seal. \nBe sure to back up the current ML configuration before performing the \nfirmware update.\n\n\n\nFor questions, contact Toptech Systems Support at security@toptech.com. \nAdditional details are available in Toptech System\u0027s firmware \nvulnerability notice: \n https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf ."
}
],
"source": {
"advisory": "ICSA-26-211-03",
"discovery": "EXTERNAL"
},
"title": "Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-12562",
"datePublished": "2026-07-30T21:29:35.378Z",
"dateReserved": "2026-06-17T20:31:31.583Z",
"dateUpdated": "2026-07-31T15:39:49.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5846 (GCVE-0-2026-5846)
Vulnerability from cvelistv5 – Published: 2026-07-30 21:12 – Updated: 2026-07-31 20:12
VLAI
EPSS
VEX
Title
Hard-coded Cryptographic Key in Watchfire Controllers
Summary
The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire's Remote Support filestore.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Watchfire | BC550 |
Affected:
12.30
Unaffected: 12.31 SP1 |
|
| Watchfire | BC750 |
Affected:
11.33
Unaffected: 11.34 Affected: 12.35 Unaffected: 12.36 SP1 |
|
| Watchfire | BC760 |
Affected:
12.38
Unaffected: 12.41 SP1 Affected: 13.00 Unaffected: 14.00 SP1 |
|
| Watchfire | BC760DC |
Affected:
12.39
Unaffected: 12.41 SP1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:31:12.383337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:31:33.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BC550",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.30"
},
{
"status": "unaffected",
"version": "12.31 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC750",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "11.33"
},
{
"status": "unaffected",
"version": "11.34"
},
{
"status": "affected",
"version": "12.35"
},
{
"status": "unaffected",
"version": "12.36 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.38"
},
{
"status": "unaffected",
"version": "12.41 SP1"
},
{
"status": "affected",
"version": "13.00"
},
{
"status": "unaffected",
"version": "14.00 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BC760DC",
"vendor": "Watchfire",
"versions": [
{
"status": "affected",
"version": "12.39"
},
{
"status": "unaffected",
"version": "12.41 SP1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James Tilson reported the vulnerability to CISA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected\u0026nbsp;Watchfire Controller Software\u0026nbsp;contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"value": "The affected\u00a0Watchfire Controller Software\u00a0contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller\u0027s built-in web management interface. These keys are embedded in plaintext within the application patch binaries in the firmware directly from Watchfire\u0027s Remote Support filestore."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:12:49.282Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWatchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\u003c/p\u003e\u003cp\u003eWatchfire has issued patches to disable the use of the existing certificate as follows:\u0026nbsp;\u003c/p\u003e\u003cul\u003e\u003cli\u003eBC550 12.30: Patch to 12.31 SP1\u003c/li\u003e\u003cli\u003eBC750 11.33: Patch to 11.34\u003c/li\u003e\u003cli\u003eBC750 12.35: Patch to 12.36 SP1\u003c/li\u003e\u003cli\u003eBC760 12.38: Patch to 12.41 SP1\u003c/li\u003e\u003cli\u003eBC760 13.00: Patch to 14.00 SP1\u003c/li\u003e\u003cli\u003eBC760DC 12.39: Patch to 12.41 SP1\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Watchfire has applied the required security patch to all affected controllers under its management. Watchfire recommends users verify their controller software version and upgrade to one of the approved versions below, if they are not already on an approved patch level.\n\n\n\nWatchfire has issued patches to disable the use of the existing certificate as follows:\u00a0\n\n * BC550 12.30: Patch to 12.31 SP1\n * BC750 11.33: Patch to 11.34\n * BC750 12.35: Patch to 12.36 SP1\n * BC760 12.38: Patch to 12.41 SP1\n * BC760 13.00: Patch to 14.00 SP1\n * BC760DC 12.39: Patch to 12.41 SP1"
}
],
"source": {
"advisory": "ICSA-26-211-09",
"discovery": "EXTERNAL"
},
"title": "Hard-coded Cryptographic Key in Watchfire Controllers",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-5846",
"datePublished": "2026-07-30T21:12:42.825Z",
"dateReserved": "2026-04-08T18:55:38.436Z",
"dateUpdated": "2026-07-31T20:12:49.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14227 (GCVE-0-2026-14227)
Vulnerability from cvelistv5 – Published: 2026-07-30 17:39 – Updated: 2026-07-30 19:15
VLAI
EPSS
VEX
Title
Insufficient session expiration in MikroTik RouterOS
Summary
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-613 - Insufficient session expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T19:15:42.794909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T19:15:52.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "RouterOS",
"vendor": "MikroTik",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andre Santos reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn API session\u2011management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user\u2011group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.\u003c/p\u003e"
}
],
"value": "An API session\u2011management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user\u2011group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient session expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:39:59.616Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMikroTik recommends administrators to ensure that when a user\u2019s permissions are downgraded, the affected user is fully logged out so the new policy can take effect.\u003c/p\u003e\u003cp\u003eFor more information, contact MikroTik (https://mikrotik.com/support).\u003c/p\u003e"
}
],
"value": "MikroTik recommends administrators to ensure that when a user\u2019s permissions are downgraded, the affected user is fully logged out so the new policy can take effect.\n\n\n\nFor more information, contact MikroTik (https://mikrotik.com/support)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient session expiration in MikroTik RouterOS",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-14227",
"datePublished": "2026-07-30T17:39:59.616Z",
"dateReserved": "2026-06-30T12:02:13.218Z",
"dateUpdated": "2026-07-30T19:15:52.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16581 (GCVE-0-2026-16581)
Vulnerability from cvelistv5 – Published: 2026-07-28 20:05 – Updated: 2026-07-29 13:59
VLAI
EPSS
VEX
Title
Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application
Summary
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-540 - Inclusion of sensitive information in source code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| igloohome | Smart Lock Mobile Application |
Affected:
Version 3.2.3
|
Date Public
2026-07-28 20:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T13:58:25.225948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T13:59:18.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smart Lock Mobile Application",
"vendor": "igloohome",
"versions": [
{
"status": "affected",
"version": "Version 3.2.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vincent C. of CodeVispera reported this vulnerability to CISA."
}
],
"datePublic": "2026-07-28T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.\u0026nbsp;\u0026nbsp;\u003cbr\u003e"
}
],
"value": "In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "CWE-540 Inclusion of sensitive information in source code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T20:05:35.105Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-06"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "igloohome has enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed.\n\u003cbr\u003e\n\u003cbr\u003eFor more information, contact igloohome (info@igloohome.com)."
}
],
"value": "igloohome has enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed.\n\n\n\nFor more information, contact igloohome (info@igloohome.com)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-16581",
"datePublished": "2026-07-28T20:05:35.105Z",
"dateReserved": "2026-07-22T13:40:37.456Z",
"dateUpdated": "2026-07-29T13:59:18.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16347 (GCVE-0-2026-16347)
Vulnerability from cvelistv5 – Published: 2026-07-28 19:59 – Updated: 2026-07-29 13:57
VLAI
EPSS
VEX
Title
Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
Summary
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-307 - Improper restriction of excessive authentication attempts
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| MikroTik | RouterOS |
Affected:
All versions
|
|
| MikroTik | Cloud Hosted Router |
Affected:
All versions
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T13:57:29.902200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T13:57:56.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "RouterOS",
"vendor": "MikroTik",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"defaultStatus": "affected",
"product": "Cloud Hosted Router",
"vendor": "MikroTik",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andre Santos of Uni\u00e3o Geek reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.\u0026nbsp;\u003cbr\u003e"
}
],
"value": "MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper restriction of excessive authentication attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:59:29.927Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.\n\u003cbr\u003e* Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.\n\u003cbr\u003e* Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.\n\u003cbr\u003e* Restrict/limit access to management services from untrusted networks.\n\u003cbr\u003e* Apply firewall rules to control and restrict access to management services where possible.\n\u003cbr\u003e* Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.\n\u003cbr\u003e* Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn\u0027t enforced by default.\n\u003cbr\u003e\n\u003cbr\u003eUsers are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support.\u0026nbsp;"
}
],
"value": "No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.\n\n* Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.\n\n* Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.\n\n* Restrict/limit access to management services from untrusted networks.\n\n* Apply firewall rules to control and restrict access to management services where possible.\n\n* Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.\n\n* Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn\u0027t enforced by default.\n\n\n\nUsers are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-16347",
"datePublished": "2026-07-28T19:59:29.927Z",
"dateReserved": "2026-07-20T20:41:22.596Z",
"dateUpdated": "2026-07-29T13:57:56.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-60134 (GCVE-0-2026-60134)
Vulnerability from cvelistv5 – Published: 2026-07-24 22:20 – Updated: 2026-07-27 14:30
VLAI
EPSS
VEX
Title
Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision
Summary
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Weintek | cMT3092X firmware |
Affected:
0 , < 20210218
(custom)
|
|
| Weintek | EasyWeb |
Affected:
0 , < v2.1.20
(custom)
Unaffected: 2.3.17-typeb |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-60134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T14:30:24.338784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T14:30:33.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cMT3092X firmware",
"vendor": "Weintek",
"versions": [
{
"lessThan": "20210218",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EasyWeb",
"vendor": "Weintek",
"versions": [
{
"lessThan": "v2.1.20",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.3.17-typeb"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vincenzo Giuseppe Colacino of Secoore reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.\u003c/span\u003e"
}
],
"value": "Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-784",
"description": "CWE-784",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:20:20.024Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-03"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-03.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (\u003c/span\u003e\u003ca href=\"https://www.weintek.com/globalw/Support/Knowledge.aspx\"\u003ehttps://www.weintek.com/globalw/Support/Knowledge.aspx\u003c/a\u003e\u003cspan\u003e) or from distributors.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support ( https://www.weintek.com/globalw/Support/Knowledge.aspx ) or from distributors."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek has published a document with more details about this issue at:\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\u003ca href=\"https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf\"\u003ehttps://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf\u003c/a\u003e"
}
],
"value": "Weintek has published a document with more details about this issue at:\u00a0\n https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf"
}
],
"source": {
"advisory": "ICSA-26-204-03",
"discovery": "EXTERNAL"
},
"title": "Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-60134",
"datePublished": "2026-07-24T22:20:20.024Z",
"dateReserved": "2026-07-16T16:04:55.188Z",
"dateUpdated": "2026-07-27T14:30:33.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61892 (GCVE-0-2026-61892)
Vulnerability from cvelistv5 – Published: 2026-07-24 22:16 – Updated: 2026-07-27 14:31
VLAI
EPSS
VEX
Title
Weintek cMT3092X Incorrect Permission Assignment for Critical Resource
Summary
Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Weintek | cMT3092X firmware |
Affected:
0 , < 20210218
(custom)
|
|
| Weintek | EasyWeb |
Affected:
0 , < v2.1.20
(custom)
Unaffected: 2.3.17-typeb |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61892",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T14:30:54.856897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T14:31:09.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cMT3092X firmware",
"vendor": "Weintek",
"versions": [
{
"lessThan": "20210218",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EasyWeb",
"vendor": "Weintek",
"versions": [
{
"lessThan": "v2.1.20",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.3.17-typeb"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vincenzo Giuseppe Colacino of Secoore reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.\u003c/span\u003e"
}
],
"value": "Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:16:58.155Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-03"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-03.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (\u003c/span\u003e\u003ca href=\"https://www.weintek.com/globalw/Support/Knowledge.aspx\"\u003ehttps://www.weintek.com/globalw/Support/Knowledge.aspx\u003c/a\u003e\u003cspan\u003e) or from distributors.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support ( https://www.weintek.com/globalw/Support/Knowledge.aspx ) or from distributors."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eWeintek has published a document with more details about this issue at:\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\u003ca href=\"https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf\"\u003ehttps://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf\u003c/a\u003e"
}
],
"value": "Weintek has published a document with more details about this issue at:\u00a0\n https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf"
}
],
"source": {
"advisory": "ICSA-26-204-03",
"discovery": "EXTERNAL"
},
"title": "Weintek cMT3092X Incorrect Permission Assignment for Critical Resource",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-61892",
"datePublished": "2026-07-24T22:16:58.155Z",
"dateReserved": "2026-07-16T16:04:55.185Z",
"dateUpdated": "2026-07-27T14:31:09.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}