Weekly Intelligence Brief on Security Alerts and Vulnerabilities - Week of September 29, 2025

Key Takeaways

• CISA released an advisory on important incident response lessons.
• Dingtian's DT-R002 faces credential vulnerabilities prompting security concerns.
• CISA issued a separate advisory focused on Industrial Control Systems (ICS) vulnerabilities.
• CISA and UK NCSC collaborated on guidance for Operational technology (OT) security.
• Emphasis on timely patching and comprehensive threat monitoring in advisories.

CISA issued a cybersecurity advisory focusing on lessons learned from an incident response engagement. The advisory emphasized the urgency of timely patching, comprehensive incident response planning, and proactive threat monitoring. These measures aim to mitigate the risks from vulnerabilities as identified through security alerts from CISA’s Endpoint Detection And Response (EDR) tool.

The advisory specified tactics used by cyber threat actors, particularly the exploitation of the GeoServer Vulnerability CVE-2024-36401 for initial access, suggesting organizations enhance their defenses. CISA recommended prioritizing patch management for critical vulnerabilities and ensuring robust incident response plans are in place to enhance organizational readiness for potential threats.

In another alert, CISA warned about security issues in the Dingtian DT-R002, highlighting vulnerabilities related to insufficiently protected credentials. Successful exploitation could enable attackers to retrieve usernames without authentication. CISA has assigned the CVE-2025-10879 identifier to this issue, which could affect all versions of the relay board. CISA has not received a response from Dingtian regarding mitigation efforts.

Furthermore, CISA published an advisory regarding security vulnerabilities within ICS, specifically the DT-R002 device. Users are encouraged to review the advisory for detailed information on mitigations. Additionally, CISA collaborated with the UK NCSC to release OT guidance, providing a framework for organizations to strengthen their cybersecurity posture and effectively manage risks associated with third-party access and system architecture.

1. CISA Releases Cybersecurity Advisory on Incident Response Lessons
   CISA issued a cybersecurity advisory on lessons learned from incident responses, stressing the need for timely patching and planning.
2. Dingtian DT-R002 faces credential vulnerabilities
   CISA warns of security issues in Dingtian's DT-R002, urging users to strengthen network security pending vendor response.
3. CISA issues ICS advisory
   CISA issued an ICS advisory highlighting security vulnerabilities on September 25, 2025.
4. CISA and UK NCSC issue joint guidance for OT security
   CISA and UK NCSC unveil guidance to enhance cybersecurity for OT systems with collaboration across teams.