CISA Issued ICS Advisories Covering Current Vulnerabilities and Exploits

CISA has issued eight Industrial Control Systems (ICS) advisories on June 24, 2025, highlighting significant security vulnerabilities across multiple vendors’ systems. 

The advisories, coded as ICSA-25-175-01 through ICSA-25-175-07, plus an update to a previously identified vulnerability (ICSA-19-029-02 Update B), provide critical information for organizations operating industrial control systems in various sectors. 

These advisories aim to alert system administrators about potential exploits that could compromise operational technology (OT) environments if left unpatched or unmitigated.

Summary
1. CISA issued eight Industrial Control Systems advisories addressing vulnerabilities across Transportation, Critical Manufacturing, Energy, and Communications sectors.
2. Multiple critical flaws identified with CVSS v4 scores ranging from 6.0 to 9.3, including remote code execution (CVE-2025-2566), buffer overflows, and authentication bypass vulnerabilities (CVE-2025-49851).
3. Several affected systems are discontinued, including Delta Electronics CNCSoft A-series and Schneider Electric EVLink WallBox, requiring immediate migration to supported alternatives.
4. Organizations must implement immediate patching, network segmentation, and defense-in-depth strategies to protect critical infrastructure assets.

Kaleris Navis N4 Terminal Operating System

CISA advisory ICSA-25-175-01 highlights severe vulnerabilities in Kaleris Navis N4 Terminal Operating System affecting versions prior to 4.0. 

The system faces two critical flaws: CVE-2025-2566, a deserialization of untrusted data vulnerability (CWE-502) with a CVSS v4 score of 9.3, allowing unauthenticated remote code execution, and CVE-2025-5087, involving cleartext transmission of sensitive information (CWE-319) with a CVSS v4 score of 6.0. 

These vulnerabilities impact the Transportation Systems sector globally, with Kaleris recommending immediate updates to versions 3.1.44+ through 3.8.0+.

Delta Electronics CNCSoft Vulnerabilities

Advisory ICSA-25-175-02 addresses four out-of-bounds write vulnerabilities (CWE-787) in Delta Electronics CNCSoft v1.01.34 and prior versions. 

CVE-2025-47724, CVE-2025-47725, CVE-2025-47726, and CVE-2025-47727 each carry CVSS v4 scores of 7.3, affecting Critical Manufacturing and Energy sectors. 

Delta Electronics has discontinued the A-series CNC products, recommending migration to newer systems as CNCSoft will be removed from their Download Center.

Schneider Electric Modicon Controllers

ICSA-25-175-03 details six vulnerabilities in Schneider Electric Modicon Controllers affecting Commercial Facilities, Critical Manufacturing, and Energy sectors. 

Key vulnerabilities include CVE-2025-3898 (improper input validation, CWE-20), CVE-2025-3899 (cross-site scripting, CWE-79), and CVE-2025-3112 (uncontrolled resource consumption, CWE-400), with CVSS v4 scores ranging from 5.1 to 7.1. 

Schneider Electric has released firmware version 5.3.12.51 for M241 and M251 controllers, with version 5.3.9.18+ available for M262 models.

Schneider Electric EVLink WallBox

Advisory ICSA-25-175-04 reveals four vulnerabilities in the discontinued EVLink WallBox system, with CVE-2025-5740 presenting the highest risk at CVSS v4 8.6. 

This path traversal vulnerability (CWE-22) enables arbitrary file writes, while CVE-2025-5743 allows OS command injection (CWE-78). 

Schneider Electric recommends upgrading to EVLink Pro AC as the replacement solution.

ControlID iDSecure On-Premises

ICSA-25-175-05 addresses three critical vulnerabilities in ControlID iDSecure On-premises versions 4.7.48.0 and prior. 

CVE-2025-49851 (improper authentication, CWE-287), CVE-2025-49852 (server-side request forgery, CWE-918), and CVE-2025-49853 (SQL injection, CWE-89) present CVSS v4 scores between 8.7 and 9.3. 

ControlID has released version 4.7.50.0 to address these vulnerabilities.

Parsons AccuWeather Widget and MICROSENS NMP Web+

ICSA-25-175-06 covers a cross-site scripting vulnerability (CVE-2025-5015) in Parsons AccuWeather Widget with CVSS v4 8.7, affecting Communications sector infrastructure. 

ICSA-25-175-07 details three vulnerabilities in MICROSENS NMP Web+ version 3.2.5 and prior, including hardcoded security constants (CVE-2025-49151) and path traversal (CVE-2025-49153) with CVSS v4 scores of 9.3.

Additionally, Mitsubishi Electric MELSEC-Q Series PLCs (ICSA-19-029-02) received Update B for legacy vulnerabilities, emphasizing the persistent threats to outdated industrial equipment.

CISA strongly encourages organizations using the affected systems to implement vendor-provided patches immediately where available. 

For systems where patches are not yet available, recommended mitigations include network segmentation, implementing proper access controls, and monitoring for suspicious activities.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now