Loading story…
Multiple security advisories have identified critical vulnerabilities in all versions of the Dingtian DT-R002 relay board, which is used in various industrial and critical infrastructure environments. The primary issue, tracked as CVE-2025-10879, involves insufficiently protected credentials, allowing remote attackers to retrieve the current user's username without requiring authentication. This vulnerability is considered highly severe, with a CVSS v4 base score of 8.7, indicating a significant risk if exploited. The vulnerability is remotely exploitable and requires low attack complexity, making it accessible to a wide range of threat actors. According to the CISA advisory, successful exploitation could enable attackers to gain unauthorized access to sensitive information, potentially facilitating further attacks or lateral movement within affected networks. The Dingtian DT-R002 relay board is widely deployed, and all versions are confirmed to be vulnerable, increasing the potential impact across multiple sectors. In addition to CVE-2025-10879, the CISA advisory also highlights a related vulnerability, CVE-2025-10880, which allows attackers to extract the proprietary "Dingtian Binary" protocol password via an unauthenticated GET request. Both vulnerabilities stem from insufficient credential protection mechanisms, underscoring systemic security weaknesses in the product's authentication design. The advisories recommend that organizations using the Dingtian DT-R002 relay board assess their exposure and implement mitigations as soon as possible. No specific affected product versions are listed, but the advisories confirm that all versions are impacted. The vulnerabilities were reported to ICS-CERT, and the advisories were published to alert critical infrastructure operators and other stakeholders. The exposure of credentials without authentication poses a risk of unauthorized access, data leakage, and potential disruption of industrial processes. Organizations are urged to monitor for further updates from Dingtian and relevant security authorities. The high severity scores reflect the ease of exploitation and the potential consequences for affected environments. Security teams should prioritize network segmentation, access controls, and monitoring for anomalous activity related to the Dingtian DT-R002. The advisories do not mention the availability of patches, so compensating controls may be necessary until vendor updates are released. The vulnerabilities highlight the importance of secure credential management in industrial control systems. Failure to address these issues could result in compromise of critical infrastructure assets. The coordinated disclosure and public advisories aim to drive rapid remediation and awareness across the sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A second high-severity vulnerability, CVE-2025-10880, was publicly listed for the Dingtian DT-R002 and described as insufficiently protected credentials. This disclosure added another distinct credential-protection issue affecting the same product.
A high-severity vulnerability, CVE-2025-10879, was publicly listed for the Dingtian DT-R002 and described as insufficiently protected credentials. The disclosure identified one of the specific credential-protection flaws affecting the device.
CISA released ICS advisory ICSA-25-268-01 covering security issues affecting the Dingtian DT-R002 device. The advisory marks the public disclosure of the vulnerabilities impacting the product.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026
Two critical vulnerabilities have been discovered in Red Lion Sixnet remote terminal units (RTUs), which are widely deployed in industrial control systems across sectors such as energy, water and wastewater treatment, transportation, utilities, and manufacturing. The vulnerabilities, identified as CVE-2023-42770 and CVE-2023-40151, both carry the maximum CVSS score of 10.0, indicating their severity and potential for exploitation. CVE-2023-42770 is an authentication bypass flaw that arises because the affected RTUs only enforce authentication on UDP port 1594, while the same port over TCP does not require authentication, allowing attackers to send unauthorized commands. CVE-2023-40151 is a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary Linux shell commands as root via the Sixnet Universal protocol. These vulnerabilities can be chained, enabling a remote attacker to bypass all authentication and gain full control over the RTU, potentially leading to significant disruptions in critical infrastructure operations. The flaws were discovered by Claroty’s Team82, who withheld full exploit details to give organizations time to patch their systems. Red Lion’s Sixnet IO Tool Kit, a Windows-based utility, is used to configure these RTUs and communicates using a proprietary protocol that was found to be susceptible to these attacks. The vulnerabilities affect both the SixTRAK and VersaTRAK series of RTUs. The user-permission system implemented in the protocol was intended to restrict access, but the lack of authentication checks on TCP traffic undermines this security measure. Security experts have warned that exploitation of these vulnerabilities could allow attackers to manipulate, disrupt, or destroy industrial processes controlled by the compromised RTUs. The affected devices are integral to automation, control, and data acquisition in industrial environments, making the risk of exploitation particularly concerning. Organizations using these RTUs are urged to apply available patches and review network segmentation to limit exposure. The vulnerabilities highlight the ongoing risks associated with legacy industrial protocols and the importance of rigorous security testing in critical infrastructure environments. Claroty’s report provides technical details on the flaws and emphasizes the need for immediate remediation. The disclosure underscores the potential for unauthenticated remote attacks to have far-reaching impacts on essential services. Security professionals recommend monitoring for unusual network activity on port 1594 and implementing strict access controls. The incident serves as a reminder of the critical need for robust authentication and secure protocol design in industrial control systems.
Jul 12, 2026
CISA released an advisory detailing two out-of-bounds write vulnerabilities in Delta Electronics DIAScreen, a product used in industrial control systems. The affected product versions include DIAScreen version 1.6.0 and prior. These vulnerabilities, identified as CVE-2025-59297 and CVE-2025-59298, can be exploited when a valid user opens a maliciously crafted project file, allowing an attacker to write data outside the allocated memory buffer. Both vulnerabilities are rated with a CVSS v3.1 base score of 6.6 and a CVSS v4 base score of 6.8, indicating a medium severity level. The attack complexity is considered low, and exploitation does not require privileges, but user interaction is necessary. Successful exploitation could result in loss of confidentiality, integrity, and availability, with a particular risk of denial-of-service or potential code execution. CISA's advisory provides technical details about the vulnerabilities and recommends mitigations to reduce risk. Administrators and users are encouraged to review the advisory and apply the recommended security measures. The vulnerabilities highlight the ongoing risks associated with file parsing in industrial control system software. Delta Electronics is a major vendor in the ICS sector, and vulnerabilities in its products can have significant operational impacts. The advisories were released on October 7, 2025, as part of CISA's ongoing efforts to inform the ICS community about emerging threats. The technical details specify that the vulnerabilities are triggered by opening malicious project files, emphasizing the importance of user awareness and safe file handling practices. The advisory does not mention active exploitation in the wild at the time of publication. CISA's notification is part of a broader set of ICS advisories released on the same date, but the DIAScreen vulnerabilities are specifically addressed in their own advisory. The disclosure underscores the need for timely patching and adherence to vendor guidance in industrial environments. Organizations using DIAScreen should assess their exposure and implement mitigations as soon as possible. The vulnerabilities are tracked under the Common Weakness Enumeration (CWE) identifier CWE-787, which relates to out-of-bounds write issues. The advisory also provides links to further technical resources and encourages feedback from the ICS community.
Jun 29, 2026