Loading story…
Forescout's Vedere Labs disclosed 22 vulnerabilities in widely deployed serial-to-IP converters from Lantronix and Silex, including the Lantronix EDS3000PS and EDS5000 series and the Silex SD330-AC. The flaws, tracked under the BRIDGE:BREAK research initiative, can enable remote code execution, authentication bypass, arbitrary file upload, firmware and configuration tampering, denial of service, information disclosure, and full device takeover. Researchers said nearly 20,000 of these devices are reachable from the public internet, putting organizations in utilities, manufacturing, healthcare, and telecommunications at risk.
The affected devices are used to connect legacy serial equipment to modern IP networks, making them a critical bridge into OT environments where compromise could disrupt communications, support lateral movement, and let attackers manipulate sensor or actuator data. Forescout said firmware analysis also found outdated Linux kernels, inconsistent security protections, and large numbers of inherited open-source and kernel vulnerabilities, with many devices lacking mitigations such as ASLR. Lantronix and Silex have released security updates, and defenders are being urged to patch promptly, remove default credentials, enforce strong authentication, segment networks, monitor for anomalous internal traffic, and eliminate direct internet exposure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CSIRT.SK reference states that Silex AMC Manager version 5.0.2 and earlier is also affected by BRIDGE:BREAK vulnerabilities and recommends upgrading to version 5.1.0 or later. It also notes interim mitigations for some Silex issues, including disabling HTTP/HTTPS or SNMP and setting a strong web administration password.
Following disclosure of the BRIDGE:BREAK vulnerabilities, Lantronix and Silex released security updates for impacted device models, including Lantronix EDS3000PS and EDS5000 Series devices and the Silex SD330-AC. Users were advised to patch promptly, change default credentials, strengthen authentication, segment networks, and avoid direct internet exposure.
As part of its BRIDGE:BREAK research, Forescout found nearly 20,000 to tens of thousands of serial-to-IP converters exposed online and observed that many devices used outdated Linux kernels and components with numerous known vulnerabilities. The researchers warned that exploitation could disrupt industrial operations, enable lateral movement, and allow manipulation of sensor or actuator data.
Forescout Research Vedere Labs discovered previously unknown vulnerabilities affecting Lantronix and Silex serial-to-IP converters used in industrial environments. The flaws could enable remote code execution, authentication bypass, device takeover, firmware or configuration tampering, denial of service, and information disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceforescout.com
Open sourceltrxdev.atlassian.net
Open sourceltrxdev.atlassian.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical vulnerabilities have been discovered in Red Lion Sixnet remote terminal units (RTUs), which are widely deployed in industrial control systems across sectors such as energy, water and wastewater treatment, transportation, utilities, and manufacturing. The vulnerabilities, identified as CVE-2023-42770 and CVE-2023-40151, both carry the maximum CVSS score of 10.0, indicating their severity and potential for exploitation. CVE-2023-42770 is an authentication bypass flaw that arises because the affected RTUs only enforce authentication on UDP port 1594, while the same port over TCP does not require authentication, allowing attackers to send unauthorized commands. CVE-2023-40151 is a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary Linux shell commands as root via the Sixnet Universal protocol. These vulnerabilities can be chained, enabling a remote attacker to bypass all authentication and gain full control over the RTU, potentially leading to significant disruptions in critical infrastructure operations. The flaws were discovered by Claroty’s Team82, who withheld full exploit details to give organizations time to patch their systems. Red Lion’s Sixnet IO Tool Kit, a Windows-based utility, is used to configure these RTUs and communicates using a proprietary protocol that was found to be susceptible to these attacks. The vulnerabilities affect both the SixTRAK and VersaTRAK series of RTUs. The user-permission system implemented in the protocol was intended to restrict access, but the lack of authentication checks on TCP traffic undermines this security measure. Security experts have warned that exploitation of these vulnerabilities could allow attackers to manipulate, disrupt, or destroy industrial processes controlled by the compromised RTUs. The affected devices are integral to automation, control, and data acquisition in industrial environments, making the risk of exploitation particularly concerning. Organizations using these RTUs are urged to apply available patches and review network segmentation to limit exposure. The vulnerabilities highlight the ongoing risks associated with legacy industrial protocols and the importance of rigorous security testing in critical infrastructure environments. Claroty’s report provides technical details on the flaws and emphasizes the need for immediate remediation. The disclosure underscores the potential for unauthenticated remote attacks to have far-reaching impacts on essential services. Security professionals recommend monitoring for unusual network activity on port 1594 and implementing strict access controls. The incident serves as a reminder of the critical need for robust authentication and secure protocol design in industrial control systems.
Jul 12, 2026
Cisco Talos disclosed **six denial-of-service vulnerabilities (six CVEs)** affecting the *Socomec DIRIS M-70* industrial gateway used for power monitoring and energy management, with impact concentrated in environments such as **critical infrastructure, data centers, and healthcare**. The issues affect **firmware 1.6.9** and can be triggered **remotely without authentication**, potentially disrupting Modbus-related processing and causing operational outages or instability in deployments where the gateway is a key communications component (RS485/Ethernet; protocols including **Modbus RTU/TCP**, **BACnet IP**, and **SNMP**). The research describes a technique to overcome hardware debugging constraints caused by the device’s STM32 **Code Read-out Protection (RDP) Level 1**, which blocks traditional JTAG-based inspection. Talos obtained an **unencrypted firmware update** and used a “**good enough**” emulation strategy: emulating only the **single Modbus-handling thread** (rather than full-system emulation) with **Unicorn Engine**, then applying **coverage-guided fuzzing with AFL** and using **Qiling** to visualize coverage and analyze crash root causes. Socomec reportedly **patched** the vulnerabilities following coordinated disclosure via Cisco’s policy.
Jun 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including network devices, workflow automation platforms, document management systems, and developer tools. Notable issues include command injection flaws in TRENDnet TEW-800MB routers (CVE-2025-15136, CVE-2025-15137), remote code execution vulnerabilities in Xspeeder SXZOS (CVE-2025-54322), Eigent (CVE-2025-68952), StreamVault (CVE-2025-66203), n8n (CVE-2025-68668), and Yealink T21P_E2 phones (CVE-2025-66738). Additional vulnerabilities involve authentication bypasses in IBM API Connect (CVE-2025-13915) and Eaton UPS Companion (CVE-2025-59887), a session token capture flaw in M-Files Server (CVE-2025-13008), prototype pollution in apidoc-core (CVE-2025-13158), and a blind SQL injection in Cloudlog (CVE-2024-44065). Several of these vulnerabilities allow for remote exploitation, with some exploits already publicly available. Vendors have responded with patches for many of the affected products, such as Eigent, StreamVault, lmdeploy, and n8n, while some issues remain with public exploits and no vendor response, as seen with TRENDnet. The vulnerabilities present risks ranging from arbitrary code execution and privilege escalation to unauthorized access and data exposure. Organizations using the affected products are strongly advised to review the relevant advisories, apply available patches, and implement recommended mitigations to reduce the risk of exploitation. The diversity and severity of these vulnerabilities underscore the importance of timely vulnerability management and monitoring for emerging threats across the software supply chain.
Jun 29, 2026