Decision Insights Threat Desk

Rockwell Automation's Studio 5000 Simulation Interface has multiple vulnerabilities, including path traversal and SSRF, impacting versions 2.02 and prior. Affected users are advised to upgrade to version 3.0.0 or later and implement security best practices to mitigate potential risks.

CISA has issued 18 advisories focused on vulnerabilities and security issues within various Industrial Control Systems (ICS).

Rockwell Automation disclosed a vulnerability in FactoryTalk Policy Manager that could lead to denial of service. The affected versions are 6.51.00 and prior, with a CVSS v4 score of 8.7. Mitigations include updating to version 6.60.00 or later and following cybersecurity best practices.

Rockwell Automation has reported a vulnerability in its Verve Asset Manager affecting multiple versions, allowing unauthorized access via the API. Affected users are urged to update to versions 1.41.4 or 1.42. The vulnerability, identified as CVE-2025-11862, has a CVSS v4 score of 8.4.

Brightpick AI's warehouse automation platform is vulnerable to multiple security issues, allowing unauthorized access to critical functions and sensitive data. CISA recommends mitigations, but Brightpick has not engaged in collaborative response efforts. Users are encouraged to secure their systems against these vulnerabilities.

CISA will cease updating ICS security advisories for Siemens vulnerabilities as of January 10, 2023. Siemens advises updating Spectrum Power 4 to V4.70 SP12 Update 2. Several serious vulnerabilities have been identified, allowing remote code execution and privilege escalation, requiring immediate attention.