RuntimeRebel — #ICS

AI-Assisted PLC Exploit Porting: WAGO RCE via Claude

Tue, 01 Sep 2026 12:56:06 GMT

Forescout researchers used Anthropic's Claude to port a WAGO PLC RCE exploit, demonstrating AI's potential in offensive security but highlighting current challenges.

Multistate Water System Attacks Target Exposed PLCs

Tue, 11 Aug 2026 08:46:26 GMT

Attacks targeting poorly secured, internet-exposed PLCs in water systems are widening across multiple U.S. states, with Iran suspected.

Coordinated OT Attack Targets 30+ Minnesota Water Utilities

Wed, 29 Jul 2026 17:17:22 GMT

Over 30 Minnesota water utilities were targeted in a coordinated cyberattack on operational technology, prompting a statewide incident response and investigation.

CVE-2024-2821: Critical RCE in Daktronics Controllers — Patch Now

Tue, 30 Jun 2026 05:28:50 GMT

Critical vulnerabilities (CVE-2024-2821, CVE-2024-2822, CVE-2024-2823) in Daktronics Venus 1500 and Vanguard controllers allow remote hacking of highway signs and…

Rockwell RSLinx <4.50.00 RCE via CVE-2020-13573 — Patch Now

Thu, 18 Jun 2026 09:58:04 GMT

Urgent advisory for Rockwell RSLinx Classic users. CVE-2020-13573, a stack-based buffer overflow, enables remote code execution and DoS. Patch <=4.50.00.

CVE-2026-11317: Rockwell Logix DoS via CIP — Patch Critical ICS

Thu, 18 Jun 2026 09:57:33 GMT

Critical Manufacturing faces high-severity DoS risk in Rockwell Automation Logix 5370 & 5570 controllers from CVE-2026-11317. Patch now.

ICS Exposure Persists as OT Attack Surface Expands

Sat, 13 Jun 2026 01:04:32 GMT

Analysis of Industrial Control System (ICS) exposure, its persistence amidst expanding attack surfaces, and vital steps for operational technology security.

Siemens KACO Blueplanet Inverter Vulnerabilities: CVE-2025-40946 & CVE-2026-41125

Tue, 09 Jun 2026 17:02:56 GMT

Critical Siemens KACO Blueplanet Inverters are vulnerable to credential derivation (CVE-2025-40946) and SQL injection (CVE-2026-41125).

Hitachi Energy MACH HiDraw RCE via CVE-2026-7310 — Patch Guide

Thu, 04 Jun 2026 17:11:13 GMT

Hitachi Energy addresses a heap-based buffer overflow in MACH HiDraw version 9.22. Learn how to mitigate CVE-2026-7310 and protect critical ICS assets.

CVE-2026-6332: Schneider Electric EcoStruxure HVAC Source Code Disclosure

Thu, 28 May 2026 17:27:39 GMT

A cleartext storage vulnerability in Schneider Electric EcoStruxure Machine Expert HVAC (CVE-2026-6332) exposes sensitive source code. Update to v1.10.0.

CVE-2021-22291: ABB EIBPORT V3 <3.9.2 Session Hijacking Vulnerability

Thu, 28 May 2026 17:27:09 GMT

ABB EIBPORT V3 devices are vulnerable to CVE-2021-22291 (XSS/session hijacking), allowing unauthenticated access and configuration changes. Patch immediately.

CVE-2026-7251: Hard-coded Password in Eppendorf BioFlo 320

Tue, 26 May 2026 20:49:09 GMT

Critical hard-coded password vulnerability (CVE-2026-7251) in Eppendorf BioFlo 320 bioreactors allows full remote control. Patch immediately.

ABB B&R Automation Studio <6.5: Multiple Critical SQLite Vulnerabilities

Sat, 23 May 2026 00:56:27 GMT

Critical SQLite vulnerabilities in ABB B&R Automation Studio <6.5 expose ICS to RCE, data exposure, and unauthorized access. Update to version 6.5 immediately.

CVE-2022-4304: Hitachi Energy GMS600 Timing Side Channel Vulnerability

Thu, 21 May 2026 20:43:48 GMT

Hitachi Energy GMS600 versions 1.3.0-1.3.1 affected by CVE-2022-4304, an OpenSSL timing side channel leading to TLS decryption. Patch to 1.3.2 now.

OT Robot OS Command Injection: Unauthenticated RCE — Patch Now

Wed, 20 May 2026 17:14:09 GMT

Critical command injection vulnerability in OT Robot OS allows unauthenticated attackers to gain remote control, posing significant disruption risks to industrial…

CVE-2026-4293: Kieback & Peter DDC XSS — Mitigate Building Controller Risks

Tue, 19 May 2026 20:43:11 GMT

CISA warns of CVE-2026-4293, a Cross-site Scripting vulnerability in Kieback & Peter DDC Building Controllers.

CVE-2026-40175: Siemens gWAP RCE via Axios Prototype Pollution

Thu, 14 May 2026 20:40:58 GMT

Siemens gWAP is vulnerable to RCE via CVE-2026-40175, a prototype pollution flaw in the Axios HTTP client library. Update to v3.1.1 or later.

CVE-2026-6411: MAXHUB Pivot Client Hardcoded AES Key — Patch Guide

Fri, 08 May 2026 08:40:11 GMT

Exploit analysis of CVE-2026-6411 in MAXHUB Pivot client. Learn how hardcoded AES keys and MQTT enrollment flaws lead to data disclosure and DoS.

ABB B&R Automation Runtime DoS via CVE-2025-11044 — Patch Now

Wed, 06 May 2026 00:49:26 GMT

An unauthenticated network DoS vulnerability (CVE-2025-11044) affects ABB B&R Automation Runtime, allowing permanent system halts. Immediate patching is critical.

CVE-2025-11043: ABB Automation Studio <6.5 Improper Certificate Validation

Wed, 06 May 2026 00:48:57 GMT

Critical manufacturing systems running ABB B&R Automation Studio <6.5 are vulnerable to CVE-2025-11043, allowing data interception and spoofing via improper certificate…

CVE-2025-14510: ABB Ability OPTIMAX Azure AD SSO Auth Bypass

Fri, 01 May 2026 00:56:01 GMT

CISA warns of CVE-2025-14510 impacting ABB Ability OPTIMAX, allowing authentication bypass on Azure AD SSO integrations. Patch immediately.

ABB AWIN Gateways Authentication Bypass and DoS Vulnerabilities

Thu, 30 Apr 2026 16:41:24 GMT

Critical vulnerabilities in ABB AWIN GW100 and GW120 gateways could allow unauthenticated attackers to reboot devices or extract sensitive configuration data.

ABB Symphony Plus Engineering: Fix PostgreSQL RCE Vulnerabilities

Thu, 30 Apr 2026 16:40:58 GMT

ABB Ability Symphony Plus Engineering is vulnerable to RCE via legacy PostgreSQL components. Learn how to mitigate CVE-2024-7348 and secure ICS networks.

NSA GRASSMARLIN XXE Vulnerability CVE-2026-6807 — Mitigation Guide

Wed, 29 Apr 2026 08:55:03 GMT

CISA warns of a Medium-severity XXE vulnerability in NSA GRASSMARLIN. With the tool reaching end-of-life, defenders must address CVE-2026-6807 via decommissioning.

CVE-2025-65856: Authentication Bypass in Xiongmai XM530 IP Cameras

Thu, 23 Apr 2026 20:27:17 GMT

Critical authentication bypass (CVE-2025-65856) in Xiongmai XM530 IP Camera firmware allows unauthenticated remote access to video streams and sensitive data.

CVE-2026-27668: Privilege Escalation in Siemens RUGGEDCOM CROSSBOW

Wed, 22 Apr 2026 08:45:24 GMT

Authenticated User Administrators can escalate privileges in Siemens RUGGEDCOM CROSSBOW SAM-P versions prior to 5.8. Update to mitigate CVE-2026-27668 risks.

Silex SD-330AC and AMC Manager RCE via CVE-2026-32956 — Patch Now

Wed, 22 Apr 2026 08:45:02 GMT

Silex Technology devices face critical RCE and DoS risks via 13 vulnerabilities. Critical infrastructure defenders must update to firmware Ver 1.50 immediately.

Securing Serial-to-IP Devices: Mitigating Thousands of OT Bugs

Mon, 20 Apr 2026 20:19:45 GMT

Industrial serial-to-IP converters are riddled with thousands of vulnerabilities, posing a significant risk to legacy infrastructure and OT environments.

CVE-2026-5387: AVEVA Pipeline Simulation Privilege Escalation

Fri, 17 Apr 2026 05:05:22 GMT

Unauthenticated attackers can exploit CVE-2026-5387 in AVEVA Pipeline Simulation <=2025_SP1_build_7.1.9497.6351 to modify critical ICS simulation parameters and training…

ICS Patch Tuesday: 8 Industrial Giants Patch Critical Vulnerabilities

Wed, 15 Apr 2026 08:40:53 GMT

Analysis of new security advisories from Siemens, Schneider Electric, and others regarding critical infrastructure vulnerabilities and remediation steps.

Iranian Actors Target Rockwell PLCs: 4,000 US Devices Exposed

Fri, 10 Apr 2026 16:24:02 GMT

Iranian-linked cyber actors have identified nearly 4,000 exposed US industrial control systems, primarily Rockwell Automation PLCs, raising critical infrastructure…

CVE-2025-13926: Critical Flaw in Contemporary Controls BASC 20T

Fri, 10 Apr 2026 08:41:43 GMT

CISA warns of a CVSS 9.8 vulnerability in Contemporary Controls BASControl20 3.1. Attackers can forge packets to reconfigure or delete PLC components.

Iran-Linked Cyber Attacks Persist Despite Israel-Hezbollah Ceasefire

Thu, 09 Apr 2026 04:52:31 GMT

Iran-affiliated threat actors maintain operational tempo against US critical infrastructure, disregarding kinetic pauses in Middle East regional conflicts.

Iranian Hackers Targeting U.S. Critical Infrastructure via PLCs

Wed, 08 Apr 2026 08:32:44 GMT

U.S. agencies warn of Iran-linked hackers disrupting critical infrastructure by exploiting internet-exposed PLCs to manipulate data and halt operations.

Mitsubishi Electric ICS Vulnerabilities Expose SQL Credentials

Tue, 07 Apr 2026 16:31:20 GMT

High-severity vulnerabilities (CVE-2025-14815, CVE-2025-14816) in Mitsubishi Electric ICS/SCADA products risk SQL credential exposure and data compromise.

Ivanti Connect Secure RCE: Internal Network Vulnerability Detection

Fri, 03 Apr 2026 08:29:48 GMT

Analyze the impact of Ivanti Connect Secure vulnerabilities and learn how to conduct internal network vulnerability scanning for Ivanti appliances to detect flaws.

Yokogawa CENTUM VP CVE-2025-7741 Hardcoded Password Patch Guidance

Fri, 03 Apr 2026 08:28:20 GMT

CISA identifies a hardcoded password in Yokogawa CENTUM VP (CVE-2025-7741). Learn how to secure the PROG account and apply the R7.01.10 patch now.

CVE-2026-3356: Anritsu Remote Spectrum Monitor Authentication Bypass

Tue, 31 Mar 2026 20:19:02 GMT

Critical CVE-2026-3356 allows authentication bypass in Anritsu Remote Spectrum Monitors.

CVE-2026-3587: WAGO Switches CLI Escape Leads to Full Device Compromise

Thu, 26 Mar 2026 16:39:32 GMT

Critical flaw CVE-2026-3587 in WAGO Industrial Managed Switches allows unauthenticated remote attackers to fully compromise devices via CLI escape.

Schneider Electric Plant iT/Brewmaxx RCE via Multiple Redis Vulnerabilities

Tue, 24 Mar 2026 20:21:08 GMT

Multiple critical and high-severity vulnerabilities in Schneider Electric Plant iT/Brewmaxx 9.60+ (Redis component) enable RCE and privilege escalation, affecting…

CVE-2026-2417: Pharos Controls RCE via Missing Authentication

Tue, 24 Mar 2026 20:20:34 GMT

Critical vulnerability (CVE-2026-2417) in Pharos Controls Mosaic Show Controller firmware 2.15.3 allows unauthenticated root RCE. Upgrade to 2.16+ immediately.

CVE-2025-13902: Patching Schneider Electric Modicon Controllers

Thu, 19 Mar 2026 16:26:40 GMT

Schneider Electric Modicon M241 and M251 controllers face XSS risks via CVE-2025-13902. Learn how to patch firmware and secure industrial control networks.

CVE-2026-2273: Schneider Electric EcoStruxure Automation Expert RCE

Thu, 19 Mar 2026 16:26:18 GMT

Schneider Electric has addressed a high-severity code injection vulnerability (CVE-2026-2273) in EcoStruxure Automation Expert that risks full system compromise.

CVE-2025-13957: Hard-coded Credentials in Schneider EcoStruxure DCE

Tue, 17 Mar 2026 20:17:31 GMT

Hard-coded credentials in Schneider Electric EcoStruxure Data Center Expert v9.0 and prior (CVE-2025-13957) allow information disclosure and RCE if SOCKS Proxy is…

ICS Patch Tuesday: Siemens, Schneider, Moxa Fix Critical Flaws

Wed, 11 Mar 2026 08:17:11 GMT

Industrial leaders Siemens, Schneider Electric, Moxa, and Mitsubishi Electric address over 40 vulnerabilities in critical ICS hardware and software components.

CVE-2025-57176: Unauthenticated File Upload in Ceragon Siklu Devices

Tue, 10 Mar 2026 20:15:45 GMT

An unauthenticated file upload vulnerability (CVE-2025-57176) in Ceragon Siklu MultiHaul and EtherHaul series devices poses risks to critical communications…

CVE-2026-3611: Critical Auth Bypass in Honeywell IQ4x BMS Controllers

Tue, 10 Mar 2026 20:15:15 GMT

CISA warns of a critical authentication bypass (CVE-2026-3611) in Honeywell IQ4x BMS Controllers, allowing unauthenticated attackers administrative access and potential…

CVE-2026-3094: Delta CNCSoft-G2 Out-of-bounds Write RCE

Thu, 05 Mar 2026 20:17:47 GMT

Delta Electronics CNCSoft-G2 is vulnerable to an out-of-bounds write (CVE-2026-3094) allowing remote code execution. Update to V2.1.0.39.

Multiple DoS/RCE Vulnerabilities in Yokogawa CENTUM VP R6, R7

Thu, 26 Feb 2026 20:16:44 GMT

CISA alerts to multiple medium-severity vulnerabilities in Yokogawa CENTUM VP R6 and R7, allowing DoS and RCE via crafted packets in critical infrastructure…

Critical Authentication Flaws in Chargemap EV Infrastructure

Thu, 26 Feb 2026 20:16:22 GMT

CISA warns of critical vulnerabilities in Chargemap EV charging stations, including unauthenticated WebSocket access and session hijacking (CVE-2026-25851).