Loading story…
A critical authentication bypass vulnerability has been identified in Raise3D Pro2 Series 3D printers, tracked as CVE-2025-10653. The flaw arises from an unauthenticated debug port that can be exploited to gain access to the device's file system. This vulnerability is remotely exploitable and does not require any authentication or user interaction, making it particularly dangerous for devices exposed to untrusted networks. The vulnerability affects all firmware versions of the Raise3D Pro2 Series printers, as confirmed by both CISA and independent vulnerability databases. Successful exploitation could allow an attacker to exfiltrate data from the device and compromise its integrity and availability. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 and a CVSS v4 base score of 8.8, indicating a high level of severity. The attack complexity is low, and the vulnerability can be exploited over the network, increasing the risk for organizations using these devices in critical manufacturing environments. The issue was reported to CISA by security researcher Souvik Kandar. Raise3D has acknowledged the vulnerability and is currently developing a patched firmware version, though no release date has been announced. In the interim, Raise3D recommends disabling developer mode on affected devices if it is not required, as the vulnerability is present when this mode is enabled. CISA further advises minimizing network exposure for all control system devices, ensuring they are not accessible from the Internet, and placing them behind firewalls. The vulnerability has implications for critical infrastructure sectors, particularly those relying on 3D printing for manufacturing processes. Organizations are urged to review their deployment of Raise3D Pro2 Series printers and apply recommended mitigations to reduce the risk of exploitation. The vulnerability highlights the importance of securing debug interfaces and restricting access to sensitive device functions. No specific incidents of exploitation have been reported at this time, but the public disclosure increases the likelihood of threat actors attempting to leverage the flaw. Raise3D has provided additional information and support through its official support center. Users are encouraged to monitor for firmware updates and apply patches as soon as they become available. The exposure of such vulnerabilities in widely deployed industrial devices underscores the ongoing need for robust security practices in operational technology environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-10653 was publicly listed as an authentication bypass using an alternate path or channel in Raise3D Pro2 Series 3D Printers. The CVE entry provided public vulnerability tracking details for the issue.
CISA published ICS advisory ICSA-25-275-01 covering a security issue affecting Raise3D Pro2 Series 3D Printers. The advisory marks the public disclosure of the vulnerability affecting these devices.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026
Security researchers have identified critical vulnerabilities in the Fiery Driver Updater, a software component embedded in print servers from major manufacturers such as Canon and Sharp. The flaws include hardcoded credentials and a lack of source file validation, which could allow attackers with prior access to exploit the updater for supply chain attacks and deliver malicious updates. These risks highlight the broader issue of printer infrastructure being an overlooked attack vector, with millions of devices potentially exposed due to poor update practices and weak security controls in printer management software. In a separate but related incident, a small business experienced a severe cyberattack after their cloud-connected smart receipt printer, running a discontinued version of Android Things, began malfunctioning and ultimately served as a gateway for malware. This case underscores the real-world impact of insecure printer devices and the dangers posed by outdated or poorly secured embedded operating systems in IoT hardware. Both findings emphasize the urgent need for organizations to treat printers and their associated software as critical components of their security posture.
Jun 29, 2026
Multiple security advisories have identified critical vulnerabilities in all versions of the Dingtian DT-R002 relay board, which is used in various industrial and critical infrastructure environments. The primary issue, tracked as CVE-2025-10879, involves insufficiently protected credentials, allowing remote attackers to retrieve the current user's username without requiring authentication. This vulnerability is considered highly severe, with a CVSS v4 base score of 8.7, indicating a significant risk if exploited. The vulnerability is remotely exploitable and requires low attack complexity, making it accessible to a wide range of threat actors. According to the CISA advisory, successful exploitation could enable attackers to gain unauthorized access to sensitive information, potentially facilitating further attacks or lateral movement within affected networks. The Dingtian DT-R002 relay board is widely deployed, and all versions are confirmed to be vulnerable, increasing the potential impact across multiple sectors. In addition to CVE-2025-10879, the CISA advisory also highlights a related vulnerability, CVE-2025-10880, which allows attackers to extract the proprietary "Dingtian Binary" protocol password via an unauthenticated GET request. Both vulnerabilities stem from insufficient credential protection mechanisms, underscoring systemic security weaknesses in the product's authentication design. The advisories recommend that organizations using the Dingtian DT-R002 relay board assess their exposure and implement mitigations as soon as possible. No specific affected product versions are listed, but the advisories confirm that all versions are impacted. The vulnerabilities were reported to ICS-CERT, and the advisories were published to alert critical infrastructure operators and other stakeholders. The exposure of credentials without authentication poses a risk of unauthorized access, data leakage, and potential disruption of industrial processes. Organizations are urged to monitor for further updates from Dingtian and relevant security authorities. The high severity scores reflect the ease of exploitation and the potential consequences for affected environments. Security teams should prioritize network segmentation, access controls, and monitoring for anomalous activity related to the Dingtian DT-R002. The advisories do not mention the availability of patches, so compensating controls may be necessary until vendor updates are released. The vulnerabilities highlight the importance of secure credential management in industrial control systems. Failure to address these issues could result in compromise of critical infrastructure assets. The coordinated disclosure and public advisories aim to drive rapid remediation and awareness across the sector.
Jun 29, 2026