For providers

Kelly Benefits, a Maryland-based benefits administration and payroll solutions provider, has confirmed that almost 264,000 individuals served by its customers Amergis, CareFirst, Beam Benefits, Intercon Truck of Baltimore, Beltway Companies, The Guardian Life Insurance Company of America, Transforming Lives, and Publications Circulation Fulfilment had their data compromised following a cyberattack in December, SecurityWeek reports.

Danny Jenkins founded ThreatLocker to revolutionize endpoint security by implementing comprehensive zero-trust controls and blocking software by default, challenging the traditional cybersecurity approach.

Picking over code doesn’t guarantee problem-free software. Only automated scans that analyze first- and third-party code can provide the total visibility required to comply with the CRA and other new digital-security regulations.

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future.

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: iSTAR Configuration Utility (ICU) Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls reports the following versions of ICU are affected: ICU: Versions prior to 6.9.5 3.2 VULNERABILITY OVERVIEW 3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121 Under certain circumstances, the ICU tool can have a buffer overflow issue. CVE-2025-26382 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2025-26382. A base score of 9.3 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Ireland 3.4 RESEARCHER Reid Wightman of Dragos reported this vulnerability to Johnson Controls, Inc. 4. MITIGATIONS Johnson Controls recommends users upgrade ICU to Version 6.9.5 or greater. For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2025-04. Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 24, 2025: Initial Republication of Johnson Controls JCI-PSA-2025-04

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Planet Technology Equipment: Planet Technology Network Products Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to read or manipulate device data, gain administrative privileges, or alter database entries. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Planet Technology products are affected: UNI-NMS-Lite: Versions 1.0b211018 and prior NMS-500: All Versions NMS-1000V: All Versions WGS-804HPT-V2: Versions 2.305b250121 and prior WGS-4215-8T2S: Versions 1.305b241115 and prior 3.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78 UNI-NMS-Lite, NMS-500 and NMS-1000 are vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data. CVE-2025-46271 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). A CVSS v4 score has also been calculated for  CVE-2025-46271. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N). 3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78 WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system. CVE-2025-46272 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). A CVSS v4 score has also been calculated for  CVE-2025-46272. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N). 3.2.3 USE OF HARD-CODED CREDENTIALS CWE-798 All affected products use hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices. CVE-2025-46273 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2025-46273. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.2.4 USE OF HARD-CODED CREDENTIALS CWE-798 UNI-NMS-Lite, NMS-500 and NMS-1000 use hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database. CVE-2025-46274 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2025-46274. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.2.5 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306 WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. CVE-2025-46275 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2025-46275. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Taiwan 3.4 RESEARCHER Kev Breen of Immersive reported these vulnerabilities to CISA. 4. MITIGATIONS Planet Technology has released patches for the following devices: WGS-804HPT (v2) WGS-4215-8T2S UNI-NMS NMS-500 NMS-1000V CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. 5. UPDATE HISTORY April 24, 2025: Initial Publication

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: ALBEDO Telecom Equipment: Net.Time - PTP/NTP clock Vulnerability: Insufficient Session Expiration 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of Net.Time - PTP/NTP clock is affected: Net.Time - PTP/NTP clock (Serial No. NBC0081P): Software release 1.4.4 3.2 VULNERABILITY OVERVIEW 3.2.1 INSUFFICIENT SESSION EXPIRATION CWE-613 The affected product is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. CVE-2025-2185 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.0 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2025-2185. A base score of 8.5 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Communications, Financial Services, Information Technology COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Spain 3.4 RESEARCHER Khalid Markar, Parul Sindhwad & Dr. Faruk Kazi from CoE-CNDS Lab reported this vulnerability to CISA. 4. MITIGATIONS ALBEDO Telecom has identified the following mitigations users can apply to reduce risk: Net.Time - PTP/NTP clock (Serial No. NBC0081P) Software release 1.4.4: Update to v1.6.1 For more information, please contact ALBEDO Telecom. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 24, 2025: Initial Publication

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Nice Equipment: Linear eMerge E3 Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Nice Linear eMerge E3 are affected: Linear eMerge E3: Versions 1.00-07 and prior 3.2 VULNERABILITY OVERVIEW 3.2.1 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP. CVE-2024-9441 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2024-9441. A base score of 9.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Italy 3.4 RESEARCHER Noam Rathaus of SSD Secure Disclosure reported this vulnerability to CISA. 4. MITIGATIONS Nice did not indicate if/when a patch would be developed. Please see Nice's E3-Bulletin for the latest information on product security. Nice also recommends the following defensive measures to minimize the risk of exploitation of this vulnerability: Minimize network exposure of devices, ensuring they are not accessible from the internet. Place the devices behind firewalls and isolate them from other networks. When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Keep your VPNs as up-to-date as possible. Change default credentials on the device. Change the default IP address of the device. See Nice's Telephone Entry Bulletin for additional information. Users should contact Nice with any questions. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 24, 2025: Initial Publication

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon M580, Modicon M340, Modicon Premium, and Modicon Quantum Vulnerabilities: Trust Boundary Violation, Uncaught Exception, Exposure of Sensitive Information to an Unauthorized Actor, Authentication Bypass by Spoofing, Improper Access Control, Reliance on Untrusted Inputs in a Security Decision, Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of these vulnerabilities may risk execution of unsolicited command on the PLC, which could result in a loss of availability of the controller. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Schneider Electric reports that the following products are affected: Modicon M580: All versions prior to 2.90 (CVE-2018-7846, CVE-2018-7849, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7853, CVE-2018-7854, CVE-2019-6808, CVE-2019-6828, CVE-2019-6829, CVE-2019-6809) Modicon Momentum CPU (part numbers 171CBU*): All versions (CVE-2018-7857) Modicon Quantum: All versions prior to 3.60 (CVE-2018-7843, CVE-2018-7845, CVE-2018-7852, CVE-2018-7856, CVE-2019-6807) Modicon Quantum: All versions (CVE-2018-7846, CVE-2018-7849, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7855, CVE-2018-7857, CVE-2019-6806, CVE-2019-6808, CVE-2018-7844, CVE-2019-6828, CVE-2019-6809) Modicon Premium: All versions (CVE-2018-7846, CVE-2018-7849, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7855, CVE-2018-7857, CVE-2019-6806, CVE-2019-6808, CVE-2018-7844, CVE-2019-6828, CVE-2019-6809) Modicon Premium: All versions prior to 3.60 (CVE-2018-7852, CVE-2019-6807) PLC Simulator for EcoStruxure Control Expert: All versions prior to 15.1 (CVE-2018-7857) Modicon Premium: All versions prior to 3.20 (CVE-2018-7843, CVE-2018-7845, CVE-2018-7852, CVE-2018-7856, CVE-2019-6807) Modicon Momentum Unity M1E Processor (part numbers 171CBU*): All versions prior to SV2.6 (CVE-2018-7857, CVE-2019-6807) Modicon M580: All versions prior to sv4.20 (CVE-2018-7855) Modicon M340: All versions prior to SV3.60 (CVE-2018-7855) Modicon MC80: All versions (CVE-2018-7855) Modicon Momentum M1E: All versions (CVE-2018-7855) Modicon M580: All versions prior to 2.80 (CVE-2018-7843, CVE-2018-7845, CVE-2018-7852, CVE-2018-7856, CVE-2019-6807, CVE-2019-6830) Modicon Quantum Safety: All versions (CVE-2018-7846, CVE-2018-7849, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7852, CVE-2018-7855, CVE-2018-7857, CVE-2019-6806, CVE-2019-6808, CVE-2018-7844) Modicon M340: All versions prior to 3.10 (CVE-2018-7846, CVE-2018-7849, CVE-2018-7843, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7845, CVE-2018-7852, CVE-2018-7854, CVE-2018-7856, CVE-2019-6807, CVE-2019-6808, CVE-2019-6828, CVE-2019-6829, CVE-2019-6809) Modicon M340: All versions (CVE-2018-7857, CVE-2019-6806, CVE-2018-7844) Modicon M580: All versions (CVE-2018-7857, CVE-2019-6806, CVE-2018-7844) Modicon MC80 BMKC80*: Versions prior to 1.80 (CVE-2018-7857) 3.2 VULNERABILITY OVERVIEW 3.2.1 TRUST BOUNDARY VIOLATION CWE-501 A trust boundary violation vulnerability on connection to the controller exists, which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller. CVE-2018-7846 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). A CVSS v4 score has also been calculated for  CVE-2018-7846. A base score of 6.9 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N). 3.2.2 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a possible denial-of-service due to improper data integrity check when sending files to the controller over Modbus. CVE-2018-7849 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7849. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.3 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause denial-of-service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus. CVE-2018-7843 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7843. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.4 EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200 An information exposure vulnerability exists, which could cause the disclosure of SNMP information when reading files from the controller over Modbus. CVE-2018-7848 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7848. A base score of 8.2 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.2.5 AUTHENTICATION BYPASS BY SPOOFING CWE-290 An authentication bypass by spoofing vulnerability exists, which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller. CVE-2018-7842 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7842. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.2.6 IMPROPER ACCESS CONTROL CWE-284 An improper access control vulnerability exists, which could cause denial-of-service or potential code execution by overwriting configuration settings of the controller over Modbus. CVE-2018-7847 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7847. A base score of 9.3 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.2.7 RELIANCE ON UNTRUSTED INPUTS IN A SECURITY DECISION CWE-807 A reliance on untrusted inputs in a security decision vulnerability exists, which could cause invalid information displayed in Unity Pro software. CVE-2018-7850 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7850. A base score of 9.3 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.2.8 OUT-OF-BOUNDS READ CWE-125 An out-of-bounds read vulnerability exists, which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus CVE-2018-7845 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7845. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.2.9 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause denial-of-service when an invalid private command parameter is sent to the controller over Modbus. CVE-2018-7852 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7852. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.10 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause denial-of-service when reading invalid physical memory blocks in the controller over Modbus. CVE-2018-7853 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7853. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.11 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a denial-of-service when sending invalid debug parameters to the controller over Modbus. CVE-2018-7854 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7854. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.12 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a denial-of-service when sending invalid breakpoint parameters to the controller over Modbus. CVE-2018-7855 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7855. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.13 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a possible denial-of-service when writing invalid memory blocks to the controller over Modbus CVE-2018-7856 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7856. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.14 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a possible denial-of-service when writing out-of-bounds variables to the controller over Modbus. CVE-2018-7857 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2018-7857. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.15 UNCAUGHT EXCEPTION CWE-248 An information exposure vulnerability exists, which could cause the disclosure of SNMP information when reading variables in the controller using Modbus. CVE-2019-6806 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2019-6806. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.2.16 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability could cause a possible denial-of-service when writing sensitive application variables to the controller over Modbus. CVE-2019-6807 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2019-6807. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.17 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists, which could cause a remote code execution by overwriting configuration settings of the controller over Modbus CVE-2019-6808 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2019-6808. A base score of 10.0 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). 3.2.18 EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200 An exposure of sensitive information to an unauthorized actor vulnerability could cause a remote code execution by overwriting configuration settings of the controller over Modbus CVE-2018-7844 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2018-7844. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.2.19 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability could cause a possible denial-of-service when sending an appropriately timed HTTP request to the controller. CVE-2019-6830 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2019-6830. A base score of 8.2 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.20 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability could cause a possible denial-of-service when reading specific coils and registers in the controller over Modbus. CVE-2019-6828 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2019-6828. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.21 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability could cause a possible denial-of-service when writing to specific memory addresses in the controller over Modbus. CVE-2019-6829 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2019-6829. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.2.22 UNCAUGHT EXCEPTION CWE-248 An uncaught exception vulnerability exists cause a possible denial-of-service when reading invalid data from the controller. CVE-2019-6809 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A CVSS v4 score has also been calculated for  CVE-2019-6809. A base score of 8.7 has been calculated; the CVSS vector string is ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: France 3.4 RESEARCHER These vulnerabilities were reported to Schneider Electric by the following researchers: Jared Rittle of Cisco Talos, Pavel Nesterov, Artem Zinenko of Kaspersky, Gao Jian of ns focus, and Dong Yang of Dingxiang Dongjian Security Lab. 4. MITIGATIONS Schneider Electric has identified the following specific mitigations users can apply to reduce risk. Please see SEVD-2019-134-11 for detailed update steps. Modicon M580: A fix is available for (CVE-2018-7846, CVE-2018-7849, CVE-2018-7848, CVE-2018-7842, CVE-2018-7845, CVE-2018-7847, CVE-2018-7850, CVE-2018-7853, CVE-2018-7854, CVE-2018-7856, CVE-2018-7857, CVE-2019-6808, CVE-2019-6828, CVE-2019-6829, CVE-2019-6830, CVE-2019-6809) on Modicon M580 firmware V3.10. A fix is available for (CVE-2018-7843, CVE-2018-7852, CVE-2019-6807) on Modicon M580 firmware V2.80. Modicon M340: A fix is available for (CVE-2018-7846, CVE-2018-7849, CVE-2018-7843, CVE-2018-7848, CVE-2018-7842, CVE-2018-7847, CVE-2018-7850, CVE-2018-7845, CVE-2018-7852, CVE-2018-7854, CVE-2018-7856, CVE-2019-6807, CVE-2019-6808, CVE-2019-6828, CVE-2019-6829, CVE-2019-6809) on Modicon M340 firmware V3.20. Modicon MC80: A fix is available for (CVE-2018-7857) on Modicon MC80 (part numbers BMKC80*). Modicon Premium Modicon Momentum Unity M1E Processor: A fix is available for (CVE-2019-6807, CVE-2018-7857) on (part numbers 171CBU*)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Vestel Equipment: AC Charger Vulnerability: Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker access to sensitive information, such as credentials which could subsequently enable them to cause a denial of service or partial loss of integrity of the charger. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of AC Charger are affected: AC Charger EVC04: Version 3.75.0 3.2 VULNERABILITY OVERVIEW 3.2.1 EXPOSURE OF SENSITIVE SYSTEM INFORMATION TO AN UNAUTHORIZED CONTROL SPHERE CWE-497 Affected versions of the Vestel AC Charger contain a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device. CVE-2025-3606 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). A CVSS v4 score has also been calculated for  CVE-2025-3606. A base score of 8.7 has been calculated; the CVSS vector string is ( AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Transportation Systems COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Turkey 3.4 RESEARCHER Cumhur Kizilari reported this vulnerability to CISA. 4. MITIGATIONS Vestel strongly suggests that users of the related AC chargers update to V3.187 or a higher version. Vestel also recommends the following mitigations to reduce risk: Avoid using open networks: Use secure methods like Virtual Private Networks (VPNs) for remote access. Regularly update VPNs to their latest versions and ensure that connected devices maintain strong security measures. Reduce network exposure for applications and endpoints. Only make them accessible via the Internet if specifically designed for and required by their intended use. Login Credentials Management: Force the end user to change the factory default username and password of the web configuration page. Remove any printed documents such as installation guides, instruction books, and quick start guides from the web where login credentials are featured. Please refer to Vestel's advisory for more information. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 24, 2025: Initial Publication