Loading story…
Delta Electronics DIALink versions V1.6.0.0 and prior are affected by two critical path traversal vulnerabilities (CVE-2025-58320, CVE-2025-58321) that can be exploited remotely to bypass authentication. The most severe vulnerability has a CVSS v4 score of 10.0. No public exploitation has been reported, and users are advised to upgrade to DIALink v1.8.0.0 or later and follow standard ICS security best practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released an advisory detailing two out-of-bounds write vulnerabilities in Delta Electronics DIAScreen, a product used in industrial control systems. The affected product versions include DIAScreen version 1.6.0 and prior. These vulnerabilities, identified as CVE-2025-59297 and CVE-2025-59298, can be exploited when a valid user opens a maliciously crafted project file, allowing an attacker to write data outside the allocated memory buffer. Both vulnerabilities are rated with a CVSS v3.1 base score of 6.6 and a CVSS v4 base score of 6.8, indicating a medium severity level. The attack complexity is considered low, and exploitation does not require privileges, but user interaction is necessary. Successful exploitation could result in loss of confidentiality, integrity, and availability, with a particular risk of denial-of-service or potential code execution. CISA's advisory provides technical details about the vulnerabilities and recommends mitigations to reduce risk. Administrators and users are encouraged to review the advisory and apply the recommended security measures. The vulnerabilities highlight the ongoing risks associated with file parsing in industrial control system software. Delta Electronics is a major vendor in the ICS sector, and vulnerabilities in its products can have significant operational impacts. The advisories were released on October 7, 2025, as part of CISA's ongoing efforts to inform the ICS community about emerging threats. The technical details specify that the vulnerabilities are triggered by opening malicious project files, emphasizing the importance of user awareness and safe file handling practices. The advisory does not mention active exploitation in the wild at the time of publication. CISA's notification is part of a broader set of ICS advisories released on the same date, but the DIAScreen vulnerabilities are specifically addressed in their own advisory. The disclosure underscores the need for timely patching and adherence to vendor guidance in industrial environments. Organizations using DIAScreen should assess their exposure and implement mitigations as soon as possible. The vulnerabilities are tracked under the Common Weakness Enumeration (CWE) identifier CWE-787, which relates to out-of-bounds write issues. The advisory also provides links to further technical resources and encourages feedback from the ICS community.
Jun 29, 2026
**Delta Electronics CNCSoft-G2** contains an out-of-bounds write vulnerability in the *DOPSoft* component’s **DPAX file parsing** that can lead to **remote code execution** in the context of the current process. The issue is tracked as **CVE-2026-3094** (ZDI-CAN-28415 / **ZDI-26-151**) and is rated **CVSS 7.8 (High)** with the vector `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`; exploitation requires **user interaction** (e.g., opening a malicious file or visiting a malicious page that triggers processing of attacker-controlled content). Affected versions are **CNCSoft-G2 prior to V2.1.0.39** (CWE-787), and Delta Electronics has issued an update to remediate the flaw. CISA’s ICS advisory highlights the potential impact to **critical manufacturing** environments and recommends standard OT hardening measures, including minimizing network exposure of control system assets, placing devices behind firewalls and isolating OT from business networks, and using more secure remote access methods (e.g., VPNs) when remote connectivity is required. Separately, CISA also added **Hikvision CVE-2017-7921** and **Rockwell Automation CVE-2021-22681** (both **CVSS 9.8**) to the **Known Exploited Vulnerabilities (KEV)** catalog due to evidence of active exploitation; this KEV action is unrelated to the Delta Electronics CNCSoft-G2 disclosure and represents a different set of exploited product vulnerabilities requiring separate remediation prioritization.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026