Decision Insights Threat Desk

AVEVA has reported a vulnerability in its Application Server Immutable Deployment Environment that could allow attackers to exploit improper HTML script neutralization. Users are advised to update to secure versions and implement defensive measures to minimize risk.

CISA will no longer update advisories for Siemens vulnerabilities. Two critical vulnerabilities in COMOS were identified, allowing for potential code execution and data infiltration. Siemens recommends updating to version 10.4.5 or later and provides mitigations to reduce risks of exploitation.

Siemens has identified a vulnerability in Solid Edge SE2025 that allows man-in-the-middle attacks due to improper certificate validation. Users are advised to update to V225.0 Update 11 or later versions and implement protective measures to minimize exploitation risks.

Mitsubishi Electric reported a vulnerability in MELSEC iQ-F Series that may allow Denial of Service attacks via improperly validated TCP packets.

AVEVA Edge versions 2023 R2 and prior are affected by a vulnerability allowing local attackers to brute-force passwords.

General Industrial Controls' Lynx+ Gateway faces multiple vulnerabilities, including weak password requirements and missing authentication. These issues could lead to unauthorized access and denial of service. Users are advised to enhance security measures and follow CISA's recommendations to mitigate risks.