Loading story…
Two high-severity vulnerabilities (CVE-2025-9494 and CVE-2025-9495) have been identified in Viessmann Vitogate 300 devices prior to version 3.1.0.1. Exploitation could allow attackers to inject OS commands or bypass security controls, potentially impacting critical infrastructure. No public exploitation has been reported, and users are strongly advised to update to version 3.1.0.1 or newer and follow CISA's recommended defensive measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-9494 was publicly listed as a high-severity OS command injection vulnerability in the Viessmann Vitogate 300, with a CVSS 4.0 score of 8.5. Publicly available details identified the affected product, vulnerability class, and severity.
CISA published ICS advisory ICSA-25-266-04 covering a security issue affecting the Viessmann Vitogate 300. The advisory marks the public disclosure of the vulnerability to defenders and asset owners.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical command injection vulnerability, tracked as CVE-2025-58428, has been identified in the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System. The flaw resides in the system's SOAP-based web services interface, which allows remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system. Successful exploitation could grant attackers full shell access, enable remote command execution, and facilitate lateral movement within affected networks, posing a significant risk to organizations relying on these systems for fuel management and monitoring. Security advisories highlight that all versions of the TLS4B system prior to 11.A are affected. In addition to the command injection issue, the system is also vulnerable to an integer overflow related to Unix time handling, which could cause system resets after the 2038 epoch rollover. The vulnerabilities are rated as critical, with CVSS scores of 9.9 (v3.1) and 9.4 (v4), and could result in denial of service, administrative lockout, or disruption of core functionalities if exploited. Organizations are urged to review vendor guidance and apply mitigations to protect against these threats.
Jun 29, 2026
A set of critical vulnerabilities has been identified in the METZ CONNECT EWIO2 series, including models EWIO2-M, EWIO2-M-BM, and EWIO2-BM running firmware versions below 2.2.0. The most severe issue is an authentication bypass (CVE-2025-41733/41734) that allows unauthenticated attackers with network access to gain administrative control over the device. Exploitation enables attackers to change configurations, manipulate data, disrupt services, and potentially render the device inoperable. Additional vulnerabilities include improper control of filename for include/require statements, unrestricted upload of dangerous file types, path traversal, and improper access control, collectively enabling remote code execution and full device compromise. CISA has issued an ICS advisory (ICSA-25-322-05) highlighting the remote exploitability and low attack complexity of these flaws, assigning a CVSS v4 base score of 9.3. The vulnerabilities stem from the commissioning wizard failing to validate device initialization, allowing attackers to set root credentials via crafted POST requests. Organizations using affected METZ CONNECT EWIO2 devices are urged to review technical details and apply mitigations to prevent unauthorized access and maintain device integrity and availability.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026