Loading story…
A critical vulnerability (CVE-2025-10127) in Daikin Security Gateway allows remote attackers to bypass authentication via a weak password recovery mechanism. Public proof-of-concept exploits are available, and Daikin has stated it will not issue a fix. CISA urges organizations to implement network segmentation and other defensive measures to mitigate risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as CVE-2025-40771 with a CVSS score of 9.8, has been discovered in Siemens SIMATIC CP and SIPLUS ET 200SP industrial communication modules. The flaw affects multiple device models, including SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, as well as SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, CP 1543SP-1 ISEC, and CP 1543SP-1 ISEC TX RAIL, specifically all versions prior to V2.4.24. The vulnerability arises from improper authentication of configuration connections, which allows unauthenticated remote attackers to gain access to sensitive configuration data on affected devices. This issue is particularly severe because it does not require any prior authentication, enabling attackers to exploit the flaw remotely without credentials. The vulnerability could be leveraged to compromise the integrity and confidentiality of industrial control systems that rely on these modules for network communication. Siemens has acknowledged the vulnerability and has released advisories to inform customers of the affected product versions. The flaw was reported by Siemens ProductCERT, and the company has urged users to update to the latest firmware version (V2.4.24 or later) to mitigate the risk. Exploitation of this vulnerability could allow attackers to alter device configurations, potentially disrupting industrial processes or enabling further attacks within operational technology environments. The vulnerability is considered critical due to the widespread use of these modules in industrial automation and the potential impact on critical infrastructure. Security researchers have highlighted the risk of remote exploitation, emphasizing the need for immediate patching and network segmentation to protect vulnerable devices. Organizations are advised to review their asset inventories to identify affected devices and prioritize remediation efforts. In addition to patching, Siemens recommends implementing network security best practices, such as restricting access to configuration interfaces and monitoring for unauthorized connection attempts. The disclosure of CVE-2025-40771 underscores the ongoing challenges in securing industrial control systems against remote attacks. The vulnerability was publicly disclosed in mid-October 2025, and security advisories have been disseminated to raise awareness among industrial operators. The incident highlights the importance of timely vulnerability management and the need for robust authentication mechanisms in critical infrastructure devices. Failure to address this vulnerability could result in significant operational disruptions and potential safety risks in industrial environments. The security community continues to monitor for signs of exploitation in the wild, and organizations are encouraged to stay informed about further updates from Siemens and relevant CERTs.
Jun 29, 2026
Multiple security advisories have identified critical vulnerabilities in all versions of the Dingtian DT-R002 relay board, which is used in various industrial and critical infrastructure environments. The primary issue, tracked as CVE-2025-10879, involves insufficiently protected credentials, allowing remote attackers to retrieve the current user's username without requiring authentication. This vulnerability is considered highly severe, with a CVSS v4 base score of 8.7, indicating a significant risk if exploited. The vulnerability is remotely exploitable and requires low attack complexity, making it accessible to a wide range of threat actors. According to the CISA advisory, successful exploitation could enable attackers to gain unauthorized access to sensitive information, potentially facilitating further attacks or lateral movement within affected networks. The Dingtian DT-R002 relay board is widely deployed, and all versions are confirmed to be vulnerable, increasing the potential impact across multiple sectors. In addition to CVE-2025-10879, the CISA advisory also highlights a related vulnerability, CVE-2025-10880, which allows attackers to extract the proprietary "Dingtian Binary" protocol password via an unauthenticated GET request. Both vulnerabilities stem from insufficient credential protection mechanisms, underscoring systemic security weaknesses in the product's authentication design. The advisories recommend that organizations using the Dingtian DT-R002 relay board assess their exposure and implement mitigations as soon as possible. No specific affected product versions are listed, but the advisories confirm that all versions are impacted. The vulnerabilities were reported to ICS-CERT, and the advisories were published to alert critical infrastructure operators and other stakeholders. The exposure of credentials without authentication poses a risk of unauthorized access, data leakage, and potential disruption of industrial processes. Organizations are urged to monitor for further updates from Dingtian and relevant security authorities. The high severity scores reflect the ease of exploitation and the potential consequences for affected environments. Security teams should prioritize network segmentation, access controls, and monitoring for anomalous activity related to the Dingtian DT-R002. The advisories do not mention the availability of patches, so compensating controls may be necessary until vendor updates are released. The vulnerabilities highlight the importance of secure credential management in industrial control systems. Failure to address these issues could result in compromise of critical infrastructure assets. The coordinated disclosure and public advisories aim to drive rapid remediation and awareness across the sector.
Jun 29, 2026
CISA released thirteen advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors including Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The advisories highlight severe security flaws such as missing authentication for critical functions, improper authorization, buffer overflows, SQL injection, and improper certificate validation. For Siemens TeleControl Server Basic, a vulnerability (CVE-2025-40765) allows unauthenticated remote attackers to obtain password hashes and perform authenticated operations on the database service, with a CVSS v3.1 score of 9.8, indicating critical risk. Rockwell Automation's FactoryTalk View Machine Edition and PanelView Plus 7 are susceptible to path traversal and improper authorization, potentially granting attackers unauthorized access to device file systems and sensitive diagnostic information. FactoryTalk ViewPoint is vulnerable to XML external entity injection, which could result in denial-of-service conditions. Siemens SiPass Integrated faces multiple issues, including buffer overflows and cross-site scripting, which could enable arbitrary code execution and unauthorized access. The Siemens SIMATIC ET 200SP Communication Processors have a missing authentication flaw that could allow attackers to access configuration data remotely. Siemens SINEC NMS is affected by a SQL injection vulnerability that could let low-privileged users escalate privileges. Siemens Solid Edge products are exposed to out-of-bounds read and write vulnerabilities, risking application crashes or code execution. Siemens HyperLynx and Industrial Edge App Publisher are vulnerable to type confusion, potentially leading to arbitrary code execution via crafted HTML pages. Hitachi Energy MACH GWS products have incorrect default permissions and improper validation issues, which could allow attackers to tamper with system files, cause denial of service, or perform man-in-the-middle attacks. The advisories provide technical details, affected product versions, and recommended mitigations, urging administrators to review and apply patches or workarounds. The vulnerabilities impact critical infrastructure sectors such as manufacturing, energy, water, and transportation, with products deployed worldwide. Many of the flaws are remotely exploitable with low attack complexity, increasing the urgency for remediation. CISA emphasizes the importance of timely action to prevent exploitation, as several vulnerabilities could lead to unauthorized access, data manipulation, or disruption of essential services. The advisories also reference the need to consult vendor-specific security updates for the most current information. Organizations are advised to assess their exposure, prioritize patching, and implement recommended security controls to mitigate these risks. The coordinated disclosure underscores the ongoing threat to ICS environments and the necessity for robust security practices across operational technology networks.
Jun 29, 2026